Privacy Policy

Effective Date: April 1, 2026 Version: 1.1 Last Updated: September 2026

1. Introduction

Autor Technologies Inc. ("Loquent," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use the Loquent AI Voice Platform ("Service").

Autor Technologies Inc. is incorporated in Ontario, Canada, and is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). Where applicable, we also comply with the General Data Protection Regulation (GDPR) and other regional privacy laws.

2. Information We Collect

2.1 Account Information

Name, email address, organization name
Role and job title
Password (stored as bcrypt hash, never in plaintext)
Account preferences and settings

2.2 Service Usage Data

Voice call recordings and transcripts
AI agent configurations, knowledge bases, and workflows
Call metadata (timestamps, duration, caller ID, call outcomes)
Platform usage analytics (features used, pages visited)
Widget interaction data

2.3 Payment Information

Billing name and address
Payment method details (processed and stored by Stripe; Loquent does not store full payment card numbers)
Transaction history and invoices

2.4 Technical Information

IP addresses and geolocation (approximate)
Browser type and version
Device information and operating system
Cookies and similar tracking technologies
API access logs

2.5 Communication Data

Support tickets and inquiries
Email correspondence
Feedback and survey responses

3. How We Use Your Information

We use personal information for the following purposes:

Purpose	Legal Basis (GDPR)	PIPEDA Basis
Providing and maintaining the Service	Contract performance	Consent at registration
Processing payments and billing	Contract performance	Consent at registration
Sending service notifications	Legitimate interest	Implied consent
Improving the Service and user experience	Legitimate interest	Implied consent
Ensuring platform security and preventing fraud	Legitimate interest	Implied consent
Complying with legal obligations	Legal obligation	Legal requirement
Providing customer support	Contract performance	Consent at contact
Analytics and performance monitoring	Legitimate interest	Implied consent

4. How We Share Your Information

Loquent does not sell your personal information. We share information only with the following categories of recipients:

4.1 Sub-processors

Sub-processor	Purpose	Data Shared	Location
Twilio	Telephony, voice calls	Call audio, phone numbers, call metadata	US & Canada
OpenAI	AI/LLM processing	Conversation context, knowledge base excerpts	US
Amazon Web Services	Cloud hosting, database	All service data (encrypted)	India (Mumbai)
Stripe	Payment processing	Billing information, payment details	US

4.2 Other Disclosures

Legal Requirements: When required by law, regulation, or legal process
Safety: To protect the rights, property, or safety of Loquent, our users, or the public
Business Transfers: In connection with a merger, acquisition, or sale of assets (with prior notice)
With Your Consent: When you explicitly authorize disclosure

4.3 Information from Google APIs

Some features of the Service work inside Google accounts that a customer chooses to connect (Gmail, Google Calendar and Google Drive). This section describes how that information is handled.

Loquent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we request, and why

Permission	Used for
Gmail, read (`gmail.readonly`)	The customer's AI employees read messages in the connected mailbox so they can answer the customer's questions about their email and draft replies and follow-ups.
Gmail, send (`gmail.send`)	An AI employee sends an email from the connected mailbox only after the customer has approved that specific email in Loquent, or has expressly set that employee to send on its own.
Google Calendar (`calendar.readonly`, `calendar.events`)	AI employees check availability and create, move or confirm appointments in the connected calendar, including Google Meet links.
Google Drive (`drive.readonly`, `drive.file`)	AI employees read the customer's documents so they can answer from them, and create and edit documents, spreadsheets and presentations for the customer.
Basic profile (`openid`, `email`)	To identify which Google account was connected and show it to the customer.

How it is used. Only to provide the features above to the customer who connected the account, through the AI employees that customer configured. Google user data is never used for advertising, never sold, never shared with data brokers, and never used to train artificial intelligence models. Loquent staff do not read it, except with the customer's request to help resolve a problem, where needed for security or legal reasons, or in aggregated, anonymised form.

How it is stored. OAuth access and refresh tokens are encrypted at rest with a key held separately from the database. Where a customer allows it, a searchable copy of the content (email messages, files) is stored encrypted in our database so answers are fast and available to every AI employee the customer allows. Every action taken in a Google account through Loquent is written to an audit log the customer can see.

Sharing. Content from a Google account is sent to our AI sub-processor (OpenAI, see 4.1) only as the input needed to answer a question or draft a reply, under terms that prohibit training on it and require deletion after processing. It is not shared with anyone else.

Retention and deletion. Disconnecting a Google account in Loquent deletes its tokens and the stored copy of its content immediately. Closing a Loquent account deletes everything within 30 days, except records we must keep by law. Access can also be revoked at any time from the customer's Google account permissions.

5. Data Retention

We retain personal information only as long as necessary for the purposes described in this policy:

Data Type	Retention Period
Account information	Duration of account + 30 days after deletion
Call recordings	90 days by default (configurable by customer)
Call transcripts	90 days by default (configurable by customer)
Payment records	7 years (legal/tax requirements)
Access logs	1 year
Support tickets	3 years

After the retention period, data is permanently deleted or anonymized.

6. Data Security

We implement robust security measures to protect your information:

Encryption at Rest: AES-256-GCM for sensitive fields (API keys, credentials, secrets)
Encryption in Transit: TLS 1.2+ for all data transmission
Password Protection: bcrypt hashing with 12 salt rounds
Access Controls: Role-based access control (RBAC) with organization and workspace isolation
Authentication: JWT-based authentication with token rotation and revocation
Input Validation: Global validation and sanitization of all API inputs
Rate Limiting: Protection against brute force and denial-of-service attacks
Webhook Verification: Cryptographic signature verification for incoming webhooks

For more details, visit our Trust Center at https://getloquent.com/trust.

7. Your Rights

7.1 Under PIPEDA (Canada)

Access: Request a copy of your personal information
Correction: Request correction of inaccurate information
Withdrawal of Consent: Withdraw consent for non-essential processing
Complaint: File a complaint with the Office of the Privacy Commissioner of Canada

7.2 Under GDPR (European Economic Area)

Access: Right to obtain a copy of your personal data
Rectification: Right to correct inaccurate personal data
Erasure: Right to request deletion of your personal data
Restriction: Right to restrict processing in certain circumstances
Portability: Right to receive your data in a structured, machine-readable format
Objection: Right to object to processing based on legitimate interests
Automated Decision-Making: Right not to be subject to solely automated decisions

7.3 Exercising Your Rights

To exercise any of these rights, contact us at privacy@getloquent.com. We will respond within 30 days (PIPEDA) or one month (GDPR).

8. Cookies and Tracking

8.1 Cookies We Use

Cookie Type	Purpose	Duration
Essential	Authentication, security, preferences	Session
Analytics	Usage patterns, performance monitoring	1 year
Functional	Feature preferences, language settings	1 year

8.2 Cookie Management

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect Service functionality.

9. International Data Transfers

Your personal information may be transferred to and processed in countries outside your country of residence, including India (AWS infrastructure) and the United States (Twilio, OpenAI, Stripe).

We ensure appropriate safeguards for international transfers through:

Data processing agreements with all sub-processors
Encryption of data in transit and at rest
Selection of sub-processors with recognized compliance certifications (SOC 2, PCI DSS)

10. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the Service at least 30 days before taking effect. Your continued use of the Service constitutes acceptance of the updated policy.

12. Contact

Privacy Officer Autor Technologies Inc. Email: privacy@getloquent.com Web: https://getloquent.com/trust

Office of the Privacy Commissioner of Canada Website: https://www.priv.gc.ca