Privacy Policy

Cypher LM (Private) Limited ("Cypher LM", "we", "us" or "our") is a global AI communications company. We build and operate an AI communications platform sold under the Cypher LM brand: Cypher V (AI voice agents that answer and make calls), Cypher M (a live call and meeting copilot that can join Google Meet as a guest), Cypher N (a note-taker that writes summaries, key details and meeting notes, optionally saved to the customer's Google Docs), Cypher S (scheduling and bookings), Cypher P (payments) and Cypher C (contacts), together with cypherlm.com and any related mobile or desktop apps (together, the "Services").

This notice applies to three groups of people, and it is important that you work out which one describes you, because your rights and our role differ accordingly:

1.1Visitors

If you browse cypherlm.com, request a demo, read our blog, or otherwise interact with us before becoming a customer, this is the full and final privacy notice that governs that relationship. We are the controller of the personal data you give us in this capacity.

1.2Customers

If your business has signed up for a Cypher LM account, registered an agent, or is otherwise party to our Terms of Service (a "Customer"), this notice governs the account, billing, usage and configuration data we hold about your business and your authorised users. We are the controller of that data.

1.3Callers, meeting participants and contacts

If a Customer's Cypher V agent called or answered a call to or from you, if Cypher M joined a meeting you were part of, if Cypher N took notes about a conversation involving you, or if your contact details sit in a Customer's Cypher C address book (together, "Callers"), the Customer decides why and how that data is collected and used. We process Caller data strictly on the Customer's instructions, as a processor, not a controller, under a data processing agreement incorporated into our Terms of Service. If you are a Caller and have questions about how your data was used, please start with the business you spoke to — we will support that business in responding to you, but we cannot act on your request alone except as described in Callers' rights and the Customer's duties.

Where this notice uses "you" without qualification, it means whichever of these three roles applies to the section being read.

This notice applies across the full Cypher LM product surface: the marketing site at cypherlm.com, the customer dashboard and admin console, the mobile and desktop companion apps where available, the Cypher Dots SMS beta, embedded widgets we provide for customers to place on their own sites, and any API we expose for Customers to integrate the Services into their own systems. It does not apply to third-party websites or services we merely link to, even where those services are listed as sub-processors in this notice — each of those providers maintains its own privacy notice, and we encourage you to read it if you interact with that provider directly.

If you are reading this notice because you received a call, text or email from a business and want to know whether Cypher LM was involved, the short answer is: possibly. Many businesses that use Cypher V do not advertise which vendor powers their phone system, in the same way a business using a call-centre provider or a CRM rarely tells its customers the brand name of that tool. What matters for your rights is not whether you can identify Cypher LM by name, but whether the business you contacted has met its disclosure and consent obligations, which we require under our Terms of Service regardless of whether the business names us publicly.

2.1When Cypher LM is the controller

We are the controller — meaning we decide the purposes and means of processing, and are accountable for it under data protection law — for:

• Website visitor data: analytics, cookies, form submissions, demo requests, newsletter sign-ups;
• Account and billing data: the names, emails and roles of the humans who sign up for and administer a Customer's workspace, and payment metadata for the Customer's own subscription to us;
• Support and sales communications you have directly with us;
• Security and fraud-prevention data we generate about use of our own platform (login attempts, device fingerprints, audit logs).

2.2When Cypher LM is the processor

We are the processor — meaning we act only on instructions from, and on behalf of, the Customer — for Call Data, meeting transcripts, notes, Cypher C contact records, booking details and any other personal data about Callers that a Customer's use of the Services generates or imports. The Customer alone decides what lawful basis it has to process that data, what disclosures it gives Callers, and how long that data should be kept (subject to the floors and ceilings described in Data retention). Our processing is governed by the data processing terms in our Terms of Service, which bind us to: process Caller data only on the Customer's documented instructions; keep it confidential; apply the security measures described in How we protect personal data; engage sub-processors only as disclosed in Sharing and sub-processors; assist the Customer with Caller rights requests; and delete or return Caller data at the end of the relationship, subject to legal retention duties.

If you are a Customer, you remain responsible for having a lawful basis to collect and process your Callers' data, for giving your Callers appropriate notice (including that they may be speaking with an AI agent and that the call may be recorded), and for honouring any rights requests your Callers make directly to you.

2.3Why this split matters in practice

The controller/processor distinction is not a legal technicality we include for completeness — it determines who you should contact first, and it limits what we are permitted to do with Caller data even if we wanted to. For example, we cannot unilaterally decide to use a Customer's Call Data to build a feature for other customers, to share it with a marketing partner, or to retain it longer than the Customer's settings allow, because doing so would exceed our processor mandate. Conversely, a Customer cannot instruct us to do something with Caller data that would be unlawful for the Customer itself to do — our Terms of Service require every Customer instruction to comply with applicable law, and we may refuse or pause an instruction we reasonably believe would not.

2.4Joint and independent activities

In a small number of cases we act independently of any single Customer's instructions even with respect to Call Data — for example, when we review aggregated, de-identified call patterns across our whole customer base to detect platform-wide abuse (such as a coordinated spam-calling campaign), or when we are compelled by law to act on specific data regardless of a Customer's wishes. In those narrow cases we act as an independent controller for that specific, limited purpose, and we document the legal basis for doing so.

We collect the categories of personal data described below. Not every category applies to every person — a visitor who never signs up will never generate Call Data, for example.

3.1Account and profile data

When you or your business creates a Cypher LM account, we collect your name, business name, work email address, phone number, password (stored only in salted, hashed form — we never store it in plain text), job title, time zone, language preference, and the roles and permissions you assign to your team members inside the workspace.

3.2Billing and subscription data

We collect your billing name, billing address, tax identifiers where applicable, the plan you are on (7-day free trial, Basic, Premium, or an add-on), invoice history, and subscription status. Full payment card numbers are never collected or stored by us — see Payments and financial data.

3.3Voice agent and workspace configuration

The instructions, knowledge-base files, scripts, FAQs, business hours, pricing sheets, voice and language selections, and any other material you upload or type so that Cypher V, Cypher M or Cypher N can represent your business. If you paste personal data about your staff, suppliers or customers into these configuration fields, we process it as part of this category, on your instructions.

3.4Call audio, recordings and derived data ("Call Data")

When Cypher V answers or places a call, we process: the live audio stream; a recording of the call where the Customer has recording enabled; an automated transcript; an AI-generated summary and extracted key details (for example the caller's stated name, reason for calling, requested appointment time, order details or complaint); the caller's phone number and caller-ID name where available; and call metadata such as date, time, duration, queue time, transfer history and outcome.

3.5Meeting notes and copilot data

When Cypher M joins a Google Meet session as a guest, or is used as a live call copilot, we process the live audio or screen-shared content needed to generate real-time suggestions, plus any transcript Cypher M produces. When Cypher N is used as a note-taker, we process the resulting summaries, key details and meeting notes, which may be written directly into the Customer's connected Google Docs if that integration is enabled.

3.6Contacts and scheduling data

Cypher C stores the contact records a Customer imports or that are created automatically from calls and meetings: names, phone numbers, email addresses, company names, tags and notes. Cypher S stores booking details: the attendee's name, contact details, the service or slot booked, and any notes attached to the booking.

3.7Payments and financial data

Cypher P and our own billing flows are processed through payment providers such as Stripe or, where applicable, local payment processors. We receive and store limited information from them — payment method type, the last four digits of a card, card brand, billing country, authorisation and settlement status, and transaction identifiers. We do not receive or store full card numbers, CVV codes or bank account credentials.

3.8Google Workspace data (only when you connect it)

If a Customer chooses to connect Google Workspace, we access only the scopes the Customer authorises during that connection flow — for example, permission to create or append to specific Google Docs for Cypher N notes, to read calendar availability for Cypher S, or to let Cypher M join a specific Meet as a guest. We do not access your broader Google account, your email, or files outside the authorised scope. You can disconnect this integration at any time in your account settings, which revokes our access going forward.

3.9Website and device data

When you visit cypherlm.com or use our web app, we and our analytics providers automatically collect your IP address, browser type and version, device type and operating system, pages viewed, referring and exit pages, approximate location derived from your IP address, and information collected through cookies and similar technologies described in our Cookie Policy.

3.10Support and sales communications

Messages, demo requests, support tickets, call-back requests, survey responses and feedback you send us, and our own records of correspondence with you, including attachments you choose to include.

3.11Cypher Dots (SMS beta)

If a Customer enables the Cypher Dots beta, which lets a Caller text a Customer's Vapi-powered agent by SMS, we process the Caller's phone number, the content of the text messages exchanged, and delivery metadata (timestamps, delivery status). This beta is currently limited to a single approved test account and is not yet available to Customers generally; if and when it is made generally available, this notice will be updated and Customers will be told what disclosures they need to give their Callers.

3.12Information we infer or generate

In addition to the data you give us directly, we generate some data ourselves as a by-product of running the Services — for example, call-quality scores, flags raised by our abuse-detection systems, A/B test group assignments, and aggregate usage statistics per account. This inferred data is treated with the same care as the category of personal data it relates to.

3.13Data from publicly available sources

We do not purchase personal data from data brokers. On rare occasions, our sales team may note publicly available professional information about a business contact (for example a title listed on a company website or LinkedIn) to tailor outreach; we do this manually and sparingly, and you can ask us to stop at any time.

• To provide the Services — operate your voice agents, answer and route calls, generate transcripts, summaries and notes, create bookings, process payments, sync results to the integrations you connect, and deliver notifications.
• To manage accounts and billing — create and secure accounts, authenticate logins, process subscriptions and invoices, and send service and billing communications.
• To provide support — respond to questions, troubleshoot configuration issues and, only when a Customer specifically asks us to, review particular calls, transcripts or settings to diagnose a problem.
• To keep the Services safe — detect and prevent fraud, spam calling, account takeover, abuse of the Services, security incidents, and violations of our Acceptable Use Policy.
• To improve the Services — measure call quality, latency and reliability, debug errors, and develop new features, preferring aggregated or de-identified data wherever that is sufficient for the purpose.
• To market our Services — send product news, case studies and offers to business contacts where the law allows. You may unsubscribe at any time using the link in each email, without affecting your ability to use the Services.
• To comply with law — meet tax, accounting, corporate and regulatory obligations, and respond to lawful requests from courts, regulators and other authorities.

We do not use Caller Call Data, transcripts or notes for marketing to Callers, and we do not build advertising profiles of Callers.

4.1Product analytics in detail

When we say we measure call quality and reliability, in practice this means things like: how often a call is transferred to a human, how long an agent takes to respond, whether a booking attempt succeeded or failed, how many turns a conversation took, and error rates by call type. We look at these metrics in aggregate across accounts, or at the individual-call level only when a Customer flags a specific call for review. We do not build a cross-Customer behavioural profile of any individual Caller.

4.2Automated decision-making

Cypher V, Cypher M and Cypher N make automated, in-the-moment decisions about how to respond to a caller or what to write in a summary — that is the core function of the product. These decisions affect the content of a call or note, but they do not produce legal or similarly significant effects about a Caller on their own (for example, they do not approve or deny credit, employment or insurance). Where a Customer configures the Services to make a decision that could have such an effect — for example, auto-approving a booking that commits the Customer to a contract — the Customer, not Cypher LM, is responsible for ensuring that use complies with any automated-decision-making rights that apply under law.

5.1How a call or meeting is actually processed

During a Cypher V call, the caller's speech is converted to text by speech-recognition technology (we use Deepgram), interpreted by a large language model to decide how the agent should respond and to generate summaries and key details (we use Google Gemini), and converted back to speech, with telephony and call routing handled by Vapi. When Cypher M joins a Google Meet as a guest, it uses a meeting-bot infrastructure provider, Recall.ai, to capture audio and video from the meeting, alongside Deepgram and Gemini for transcription and live suggestions.

5.2No training of third-party foundation models on your data

We do not permit Vapi, Google Gemini, Deepgram or Recall.ai to use Customer Call Data, transcripts, notes or recordings to train the general-purpose models they make available to other customers of theirs, and our agreements with these providers prohibit it. Any model fine-tuning or feature improvement we perform ourselves uses aggregated or de-identified data wherever that is sufficient for the purpose.

5.3Human review

Automated systems process the overwhelming majority of calls and meetings without a human ever listening to or reading them. A human at Cypher LM will only access the content of a specific call, recording or transcript with the Customer's permission — typically because the Customer has raised a support ticket about that call — or where we reasonably believe doing so is necessary to investigate a safety, security or legal issue (for example a report of illegal content or an active abuse investigation).

5.4Accuracy and Customer responsibility

AI-generated transcripts, summaries, notes and suggested responses can contain mistakes, omissions or misattributions. Customers are responsible for reviewing AI output before relying on it for decisions that matter, and for correcting their own Callers' records where needed.

5.5Data minimisation in our AI pipeline

We configure our integrations with Vapi, Google Gemini and Deepgram to send only the data those providers need to perform their specific function — for example, the speech-to-text provider receives audio but does not need, and is not given, a Caller's billing history, and the summarisation model receives transcript text but is not given raw payment data. Where a provider offers a setting to disable retention of inputs on their side beyond what is needed to deliver the response, we enable it.

5.6Prompts, instructions and knowledge bases

The instructions, scripts and knowledge-base content a Customer writes to configure their agent are themselves processed by the underlying language model in order to generate responses. If a Customer includes personal data about third parties in these configuration fields (for example, "do not book appointments for John Doe"), that data is processed as Call Data for the purposes of this notice, and the Customer is responsible for having a basis to include it.

Where data protection law requires us to identify a legal basis (notably the EU GDPR and UK GDPR), we rely on the following, and we tell you which one applies to a given use if you ask:

• Performance of a contract — to provide the Services you or your business signed up for, including creating your account, running your voice agents, and billing your subscription.
• Legitimate interests — to secure, maintain and improve the Services, to prevent fraud and abuse, and to market our Services to business contacts, in each case only where those interests are not overridden by your rights and interests.
• Consent — for non-essential cookies, certain marketing communications, and any processing we specifically ask your permission for. You may withdraw consent at any time, without affecting processing carried out before withdrawal.
• Legal obligation — to meet our tax, accounting, corporate and regulatory duties, and to respond to lawful requests from authorities.

For Call Data and other data we process as a processor on a Customer's behalf, the Customer is responsible for identifying its own legal basis (for example consent from or legitimate interest in respect of its Callers), and we support the Customer in giving effect to that basis.

6.1Special category and sensitive data

We do not ask Customers to configure their agents to collect special category data (such as health, religious belief, sexual orientation or racial or ethnic origin) or financial account credentials as a matter of course. Because Callers can say anything during a call, it is possible that a transcript will incidentally capture sensitive information a Caller volunteers — for example, mentioning a medical appointment or a health condition as the reason for calling. We treat any such information with the same security measures as the rest of Call Data, and Customers must not deliberately configure an agent to elicit special category data unless they have a valid legal basis and appropriate safeguards in place to do so.

6.2Automated calling and telecom compliance

Cypher V can be configured to make outbound calls — for example, appointment reminders, follow-ups or outreach campaigns. Many countries and states regulate automated and prerecorded calls, telemarketing and do-not-call lists (for example the US Telephone Consumer Protection Act, equivalent EU and UK rules, and equivalent rules in other countries). Customers are solely responsible for obtaining any consent required before placing outbound calls, honouring do-not-call and opt-out requests, and complying with calling-hours and disclosure rules in the jurisdictions they call into. We provide configuration options (such as call-time windows, opt-out keyword handling and do-not-call list uploads) to help Customers meet these duties, but we do not independently verify that a Customer's campaign is lawful before it runs, and we are not a party to the Customer's relationship with its Callers.

If you are a Caller who believes you received a call in violation of applicable telemarketing law, please tell the calling business directly and ask to be placed on their do-not-call list; most Cypher V agents can process this request immediately. If the business does not honour your request, you may also contact contact@cypherlm.com and, where we have cause to believe a Customer is violating these laws or our Acceptable Use Policy, we will investigate and may suspend the Customer's access to outbound calling features.

We do not sell personal data, to anyone, under any circumstances. We share personal data only in the following ways:

• Sub-processors — the named service providers in the table below, each bound by a data processing agreement limiting their use of the data to providing their service to us.
• Integrations you choose — when you connect Google Workspace, a CRM, a calendar or a payment provider, we send that integration the data needed to make it work, under the permissions you grant.
• The Customer — Call Data, notes, transcripts and contact records about a Caller are made available to the Customer whose agent generated them.
• Business transfers — in connection with a merger, acquisition, financing, reorganisation or sale of some or all of our assets, subject to this notice continuing to apply to the data transferred.
• Legal and safety reasons — where required by law, a valid court order, or a lawful request from a public authority, or to protect the rights, property or safety of Cypher LM, our Customers, Callers or the public.
• With your consent — in any other case where you ask us to share data or agree to it.

7.1Sub-processor table

Cypher LM serves customers worldwide, and the sub-processors listed above operate infrastructure in the United States, the European Union and other countries. As a result, your personal data will typically be processed outside the country where you live. When we or our sub-processors transfer personal data internationally, we rely on contractual commitments that require the recipient to protect the data to a standard consistent with this notice, and, where applicable law requires it, on recognised transfer mechanisms such as standard contractual clauses. If you would like more detail about a specific transfer, contact contact@cypherlm.com.

8.1Access by our own team

Our own team works from more than one country and may access data from those locations when they need to support you or operate the Services. Wherever our systems or people are located, we apply the safeguards described in How we protect personal data and the transfer protections described above.

8.2Government access requests

We may receive requests for personal data from government authorities, including authorities outside the country where the data originated. We scrutinise every such request to confirm it has a valid legal basis before responding, we push back on requests we believe are overbroad or unlawful, and, where we are not legally prohibited from doing so, we will notify the affected Customer before producing their data so the Customer has an opportunity to object through appropriate legal channels.

These are default periods. A Customer's own configuration, applicable law, or an active legal hold may extend or shorten them for specific data.

9.1Account closure and offboarding

When a Customer closes their account, we deactivate access immediately and begin a deletion process for the data categories above that are tied to the account's own retention settings. Data subject to a longer statutory retention period (such as billing and tax records) is retained in a restricted, access-limited state for that period and then deleted. A Customer can request an export of their Call Data, contacts, bookings and notes before closing their account, and we recommend doing so, as recovery after the deletion windows above have passed is not possible.

9.2Backups

We maintain encrypted backups of production data for disaster-recovery purposes. Backups are retained on a rolling cycle (typically up to 90 days) and are not individually searchable or editable outside of a full restore process; a deletion request is honoured in our live systems immediately and in backups as those backups age out of the rolling cycle.

We use technical and organisational measures designed to protect personal data, including encryption of data in transit and at rest, access controls based on least privilege, multi-factor authentication for administrative access, logging and monitoring of access to production systems, regular vulnerability management, and vetted infrastructure providers (AWS, MongoDB Atlas) with their own strong security programs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities without undue delay, as required by applicable law.

10.1Access controls

Access to production systems that hold Call Data, transcripts and account information is limited to employees and contractors who need it to do their job, is logged, and is reviewed periodically. Administrative access requires multi-factor authentication, and we revoke access promptly when someone's role changes or their employment ends.

10.2Vendor security review

Before we engage a new sub-processor that will touch personal data, we review its security posture, certifications and contractual commitments, and we require it to notify us promptly of any security incident affecting our data so we can meet our own notification obligations to you.

10.3Your own responsibilities

Security is a shared responsibility. You should use a strong, unique password for your Cypher LM account, enable any additional authentication options we offer, restrict workspace access to team members who need it, and tell us immediately at support@cypherlm.com if you suspect unauthorised access to your account.

11.1If you are in the European Economic Area or United Kingdom (GDPR / UK GDPR)

You have the right to: access the personal data we hold about you; rectify inaccurate data; erase your data; restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time where we rely on it. You also have the right to lodge a complaint with your local data protection authority.

11.2If you are in California (CCPA / CPRA)

You have the right to: know what personal information we collect, use, disclose and (we reiterate) do not sell; delete personal information we hold about you, subject to exceptions; correct inaccurate personal information; and opt out of any sale or "sharing" of personal information for cross-context behavioural advertising — which we do not do. We will not discriminate against you for exercising these rights.

11.3If you are anywhere else

Wherever you live, we give you the same access, correction and deletion rights described above as a matter of policy, and we comply with the data-protection and privacy laws that apply to you in your country.

11.4How to exercise these rights

Email contact@cypherlm.com. We may need to verify your identity before acting on a request, and we will respond within the time required by applicable law (generally within 30 days). If your request concerns Call Data, notes, contacts or bookings held on behalf of a business you contacted or that contacted you, we will refer your request to that business, as it controls that data, and we will support it in responding to you.

If you are a Caller, meeting participant or contact whose data was processed through a Customer's use of the Services, the Customer — not Cypher LM — is responsible for: telling you that you may be speaking with an AI voice agent; telling you when a call or meeting is being recorded or transcribed; obtaining any consent required by the law that applies to that call, meeting or contact; and honouring your rights requests directly, including deletion, correction and access. We require Customers to meet these obligations under our Terms of Service, and we provide tools (such as deletion and export functions) to help them do so. If a Customer does not respond to your request, you may contact contact@cypherlm.com and we will assist as described above.

12.1Children

The Services are built for businesses and are not directed to children. You must be at least 18 years old to create a Cypher LM account. We do not knowingly collect personal data from children under 13 through our website. If you believe a child has provided us with personal data, contact contact@cypherlm.com and we will delete it.

We use cookies and similar technologies to run cypherlm.com and our web app, remember your preferences, keep you signed in, and understand how our pages are used. Full details, including the categories of cookies we use and how to control them, are in our Cookie Policy.

Everything on cypherlm.com and inside the Services — code, design, layouts, product names, copy, videos, voices, prompts and documentation — is the exclusive property of Cypher LM (Private) Limited and is protected independently of this notice. This notice governs personal data only; it does not grant any right to copy, scrape or reuse our content or product. See the Intellectual property and brand protection section of our Terms of Service for the full terms, which we enforce strictly.

We may update this Privacy Policy from time to time to reflect changes to the Services, our sub-processors, or applicable law. We will post the updated version on this page and change the effective date above. If a change is material, we will give you additional notice — for example by email or inside the app — before it takes effect.

For privacy questions, rights requests, or anything else covered by this notice, contact us. We reply within 24 hours on business days.