EnactVoice · Legal

Privacy Policy

Last updated: 2026-10-09 · Effective: 2026-10-09

1. Who we are

EnactVoice is made by EnactSkill LLC, a Florida limited liability company (“EnactSkill”, “we”, “us”). We are the data controller for the personal data described here. You can reach us at support@enactvoice.com.

2. What this policy covers

This policy covers the EnactVoice iOS app — voice and text conversations with Modal, our AI assistant — and the enactvoice.com website.

3. What we collect

• Account data. Your name, email address, and sign-in identity (Apple, Google, or email). If you sign in with Apple or Google, we receive the name and email your provider shares — never your provider password.
• Voice audio. Your speech streams to our processing pipeline during a conversation. Audio is processed in transit, and we do not store it. While EnactVoice is in testing, LiveKit keeps a recording and a transcript of each conversation for up to 30 days, unless it starts with Private session on or Save history off. In Live mode, OpenAI can keep your audio for up to 30 days. See section 4.
• Camera and screen frames. If you turn on the camera or share your screen during a conversation, we take up to one recent still frame when you finish a spoken turn or send a typed message, so Modal can see what you are showing it. We do not record video. No image is written to your transcript. See section 4.
• Transcripts. The text of your conversations — what you said and what Modal said — is stored when you allow conversation history, so your saved threads and Modal’s recall work.
• Preferences and memories. Settings you choose, and facts Modal saves when your memory settings allow it, plus concise summaries of saved conversations for recall. See section 7.
• Usernames and passwords, if you ask Modal to remember one. A password is encrypted at rest in Supabase Vault and never stored in readable form. Modal cannot read one back to you out loud — not in a call, not in a transcript, and not on anyone else’s request. The only way to see it again is on your own device, behind Face ID, Touch ID or your passcode. You choose whether Modal may save these at all, under What Modal may remember, and you can set that kind to Never.
• Files you share. Photos, documents, screenshots. Whatever you hand to Modal. Saved files are kept in storage. When cross-session memory is allowed, we also keep a short record: name, type, size, a description, and for a photo the date it was taken and the town or city it was taken in. Temporary files stay in the current session. See section 5.
• Data from accounts you connect. If you connect Google, or let Modal reach the calendar, reminders, contacts, mail, or messages on your iPhone, what it reads there enters the conversation. See section 9.
• Usage and device data. App events, session metadata, approximate device characteristics, and diagnostics through PostHog. No advertising identifiers, no cross-app tracking.

4. How voice conversations are processed

When you talk to Modal, your audio moves through this pipeline:

• Transport. Audio streams over an encrypted WebRTC connection through LiveKit Cloud.
• Transcription. Soniox converts your speech to text in real time.
• Understanding. The model you pick reads the transcript and produces Modal’s reply. Claude models run at Anthropic. Astra runs at OpenAI. Sol, Terra and Luna run at OpenAI through LiveKit Inference, and Gemma runs on LiveKit’s own infrastructure. If the model you picked is unavailable, a supported backup from the same model provider may handle the turn. If none is available, the turn fails instead of sending it to a different model provider. None of these companies trains on your conversations.
• Speech. Soniox synthesizes Modal’s reply into audio. Modal’s voice is synthetic — it is not a recording or clone of any real person.
• Live mode. If you turn on Live mode, your audio also goes straight to OpenAI’s realtime voice model, which listens and speaks while the model you picked does the thinking.

We do not store your audio. When you allow conversation history, we keep the transcript in our database in Frankfurt.

LiveKit’s testing copy. While EnactVoice is in testing, LiveKit keeps a recording of each conversation, your voice and Modal’s, with its transcript and logs of how it ran, which can include what was said. LiveKit keeps them for up to 30 days so we can find and fix problems, then deletes them. Start a conversation with Private session on, or Save history off, and LiveKit keeps no recording or transcript of it. Turning Private session on, or Save history off, during a conversation stops further history and memory writes. If that session may be recorded, we disable its audio input and output and end it. Start a new private session to continue. Recording options cannot change within a running session, and ending it does not delete what LiveKit has already collected. Deleting your account does not remove this copy sooner; see section 12.

OpenAI. What reaches it directly (Astra, and Live mode’s voice, audio included) can be kept by OpenAI for up to 30 days, for example to detect abuse, and longer only if the law requires it. OpenAI does not use it to train its models. What reaches OpenAI through LiveKit Inference is not kept.

Camera and screen. Both are off until you turn one on. While one is on, its feed streams through LiveKit. We send up to one recent still frame to the reply model when you finish a spoken turn or send a typed message. It travels with that message. If both are on, we use the screen. We do not record video. We do not send new frames to the reply model between turns, and we drop any frame older than two seconds.

A frame goes to the same company that handles the rest of that turn. Which company that is depends on your model setting and on which services are reachable — see section 8.

Vision is available only with a model that supports images. In Live mode, the model you picked reads the frame. OpenAI’s realtime voice model receives the answer as text to speak; it does not receive the image.

How long a frame lasts. On our side, a frame is never written to a database, a file, or a log. It stays in the working memory of that one conversation, so Modal can refer back to recent frames. It goes when the conversation ends. Your transcript holds text, never images.

When Anthropic handles the turn, it deletes the frame within 30 days. If its safety systems flag a conversation, it can hold the frame for up to two years. When OpenAI handles the turn directly, it can hold the frame for up to 30 days. The law can require either to hold data longer. The companies LiveKit routes to hold nothing.

We do not use camera or screen frames to identify anyone. We do not use them to infer emotion or any other characteristic of a person. That applies to anyone else who ends up in the frame, not just you.

5. Files you share

Saved files. When conversation history is on and the scope permits saving, a file goes from your device straight to our storage in Frankfurt. Our server reads it so Modal can answer questions about it. A PDF is read by Anthropic’s Claude, and that reading goes to the model you picked. Plain text goes to the model you picked. An image goes to that model when it supports images. For a saved image’s cross-session record, Claude also writes a one-sentence description.

Temporary files. Files are temporary with Private session on, Save history off, or session-only scope. They travel through LiveKit’s realtime byte streams to the current conversation. We do not put them in file storage, create a saved file record, or add them to a recall index. The PDF, text, and image processing described above still applies, except that no saved-image description is created. On our side, their contents stay in that session’s working memory and are discarded when it ends. Vendor handling in section 8 still applies.

A photo carries more than its picture. We read what the file itself records: the date it was taken, the camera, and the coordinates. The coordinates become a town or city on our own servers, matched against a lookup table we hold. They go to no one, and we do not store them. The town is what we keep in a saved photo’s cross-session record.

When cross-session memory is allowed, Modal can retrieve relevant file records, including the town, to help find a file in a later conversation. Automatic recall uses short records. Reading the file again is a separate step.

What a file contains becomes part of the conversation you shared it in. With conversation history on and a scope that permits saving, text from a file or its PDF reading can be stored with the transcript. Image bytes are never written to the transcript. Temporary file contents are not saved with a transcript.

6. Training consent

By default, your conversations are not used to train AI models. During onboarding — and any time after, in Settings — you can turn on the Training toggle. With it on, we may use your conversation transcripts to improve EnactVoice, including reviewing calls for quality and accuracy. Turning it off stops future use; it does not recall copies already incorporated into completed work. The toggle covers the text of your conversations. Camera and screen frames are not retained on our side, so they are never part of any training set. The toggle does not change that. Our AI vendors process your conversations to provide the service, under agreements that bar them from training on your data. That bar covers the frames you share, not just the words you say.

7. How we use your data

• To run the service: conversations, history, memory, voice processing, and camera or screen frames when you turn one on.
• To secure it: abuse prevention, rate limiting.
• To operate it: diagnostics, performance measurement, support.
• To bill it: subscription state through Apple. We never see your card number.
• To answer Apple about a refund you asked for. Starting November 8, 2026, when you ask Apple to refund an EnactVoice purchase and Apple asks us about it, we may send Apple facts about that purchase: whether it was delivered and worked, whether we offered a free trial, a free sample, or a description of what it does before you bought it, and for a credit pack, how much of it you used. For a subscription, we do not send how much you used. This is tied to that purchase’s App Store transaction, not to your name or email. We do not send your conversations, audio, or files. We do not ask Apple to grant or refuse your refund. Apple decides every refund. You agree to this by accepting our Terms (section 4). You can stop this by deleting your EnactVoice account; we then stop answering Apple about your purchases. Apple says it uses this information to help review refund requests and handles it under Apple’s Privacy Policy, which also covers whom Apple shares it with. To see or delete what Apple holds, go to privacy.apple.com.
• To improve it — only with your Training consent, per section 6.

Recall. Cross-session memory is the default. When allowed by your settings, Modal automatically retrieves a small set of relevant saved preferences, concise conversation summaries, and file records. It uses those notes in the current turn. Searching past transcripts requires an explicit request, such as “search our past conversations about pricing.” We store summaries and search embeddings to support this recall.

Memory scope. Session-only and private scopes keep conversation context for the current session without saving its transcript, facts, summaries, files, or search embeddings. Thread-only scope saves that conversation for you to reopen, without making it available for recall in other threads. Cross-session scope allows saved context to be used in other conversations. Private session or Save history off disables cross-session recall, memory extraction, and new recall storage. Context within the current session still works. Vendor retention in section 4 still applies.

Your controls. The app shows source references when it uses recalled conversations, preferences, or file records. You can edit, pin, or exclude conversation summaries from recall, and delete saved facts, files, or conversations. Excluding a summary or deleting a saved fact does not delete the conversation it came from. Your memory settings also control whether new facts are saved and whether saved facts are used to personalize replies.

We do not sell personal data. We do not share it for cross-context behavioral advertising. There is no advertising in EnactVoice.

8. Sub-processors

These vendors process EnactVoice user data on our behalf:

Which AI company handles a turn depends on the model you pick and on which services are reachable. Claude models use Anthropic. Astra and Live mode’s voice use OpenAI directly. Sol, Terra and Luna use OpenAI through LiveKit Inference. Gemma uses a model LiveKit runs on its own infrastructure. If a company becomes unavailable mid-conversation, a supported backup from the same model provider may handle that turn; otherwise the turn fails. Transcription and speech can use the backup processors listed above. LiveKit contracts with every company it routes to on a zero-retention basis: they do not log, store, or train on your conversations. A request that goes to OpenAI directly is covered by OpenAI’s own terms instead, which let OpenAI keep it for up to 30 days (section 4).

Accounts you connect are not on this list. The difference matters. These vendors process your data on our behalf, under our instructions. A connected account is a service you already use, answering on your authority. Google decides how it handles your mail and your files, and we cannot instruct it. We ask; your permission is what makes the answer possible.

What a connector returns, and what a file contains, enters the conversation. From there it reaches whichever company handles that turn, from the table above.

9. Connected accounts

Connectors are off until you turn them on, and they work only while a conversation is open. Nothing reads your accounts in the background.

Apple. Calendar, reminders, contacts, mail, and messages are granted by iOS and held by iOS. Only you can withdraw them, in your iPhone’s Settings. The permission stays on your phone; the data does not. What Modal reads there enters the conversation and reaches the same companies that handle the rest of it. Mail and Messages open a draft on your screen for you to send. Neither can send anything by itself.

Google. One permission wearing many faces. Google issues a single credential covering everything you have agreed to, and offers no way to hand back part of it. Three things are worth knowing before you connect. Connecting Gmail grants a permission that can send mail as you, because Google offers no draft-only permission. Modal’s tools never send. Connecting Drive, Docs, Sheets, or Slides grants access to the files this app makes for you. The rest of your Drive is closed to it. Google gives no create-only permission, so the same grant can delete a file the app made — never one you made. No tool in the app deletes a file. The permission is what you grant, so the permission is what we disclose.

The third is about Google’s screen, not ours. Its consent sheet says the Docs, Sheets, and Slides permissions can delete all your documents. They cannot delete one. The one that can delete is the Drive permission beside them, and it reaches only files the app made. The app says each of these on the connector’s row before you tap.

If you connected Docs, Sheets, or Slides before this version took effect, your grant still includes read access to your whole Drive. Disconnecting Google and reconnecting replaces it with the narrower grant.

Switching a connector off takes that access away from Modal. Disconnecting Google takes all of it away. Neither shrinks the permission. It lives in your Google account, and you withdraw it there, at myaccount.google.com/permissions. Deleting your EnactVoice account withdraws it for you.

We hold the credential Google issued under it. Connecting gives Google nothing new about you. Every action Modal takes on a connected account is recorded, so you can ask what it did.

EnactVoice’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. Where data lives and moves

Stored data — your account, transcripts, preferences, memories — lives in Supabase’s Frankfurt region (EU). Real-time processing is different: voice transport, transcription, and AI inference run on US infrastructure while a conversation is live. Saved files are stored in Frankfurt and read by our processing server in the US. Temporary files go to the current session’s processing server in the US without being saved in file storage. Data from a connected account is read in the US. Camera and screen frames travel the same path. For transfers out of the EEA and UK we rely on Standard Contractual Clauses with each vendor.

11. Data retention

• Voice audio: we do not store it. While EnactVoice is in testing, LiveKit keeps a recording and a transcript of each conversation for up to 30 days, unless it starts with Private session on or Save history off. In Live mode, OpenAI can keep your audio for up to 30 days. Vendor retention in section 4.
• Camera and screen frames: not retained by us; held only until the conversation ends. Vendor retention in section 4.
• Transcripts, preferences, memories: kept while your account exists, or until you delete them in the app. Encrypted details are the exception.
• Encrypted details: kept for 12 months, then deleted. You can delete one sooner in the app.
• Saved files and their records: kept until you delete them. There is no automatic expiry. Temporary files stay in working memory only until the session ends.
• Connector permissions: kept until you disconnect.
• The record of what Modal did on a connected account: kept while your account exists.
• Analytics events: up to 12 months.
• Billing records: held by Apple and in our accounting records for 7 years, as tax law requires.
• Backups: deleted data ages out of encrypted backups within 90 days.

12. Deleting your account

In the app: Settings → Profile → Delete account. This removes your account, transcripts, memories, preferences, connector permissions, and the records of files you shared, from our live systems at the time of the request. Backup copies age out per section 11. Subscription management and refunds for App Store purchases remain with Apple.

Two of those go beyond our own records. The files you shared are removed from our storage, not merely unlisted. Any account you connected is withdrawn at the provider first, so EnactVoice stops being listed in your Google account rather than keeping a key to it.

Both happen before anything else is deleted, and if either fails the deletion stops and your account is still there. That is deliberate. An account that still exists can be deleted again; a permission stranded behind a deleted account can never be withdrawn by anyone. So if Google cannot be reached, deletion is refused.

Deleting one file in the Library removes both the file and its record.

Deleting your account does not remove LiveKit’s testing copy of your recent conversations. LiveKit deletes each one within 30 days of the conversation. See section 4.

13. Your rights

Depending on where you live (GDPR, UK GDPR, CCPA/CPRA), you can request access to your data, a copy of it, correction, deletion, restriction of processing, or object to processing. Write to support@enactvoice.com and we respond within 30 days. We do not discriminate against you for exercising these rights. You can also complain to your local supervisory authority.

14. Age requirement

EnactVoice is for adults. You must be at least 18 to create an account, and we do not knowingly collect personal data from anyone under 18. If we learn we hold data on someone under 18, we delete it.

15. You are talking to an AI

Modal is an AI assistant, not a person. Its voice is synthesized. Its answers can be wrong, and nothing it says is professional advice. We say this in the app, and it belongs in the privacy policy too: the party processing what you say in a conversation is software.

16. Changes to this policy

When we make material changes we update the date above and give notice in the app or by email at least 30 days before the change takes effect, where required.

17. Contact

EnactSkill LLC · Ponte Vedra, FL, USA · support@enactvoice.com