Privacy Policy

Effective Date: May 1, 2026  |  Last Updated: May 20, 2026

1. Introduction

ExtenX ("we," "us," or "our") is committed to protecting the privacy of our customers and users. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our virtual business phone system platform and related services (collectively, the "Services").

This policy applies to information collected through our website, web application, mobile applications, APIs, and all related services. By using our Services, you consent to the data practices described in this Privacy Policy.

2. Information We Collect

2.1 Account Information

When you register for an account, we collect:

• Name, business name, and contact information (email address, phone number, mailing address)
• Account credentials (username and encrypted password)
• Billing information (payment card details processed by our payment processor; we do not store full card numbers)
• Business type and industry information

2.2 Call Metadata

When calls are made or received through the Services, we collect metadata including:

• Caller and recipient phone numbers
• Call duration, timestamps, and call direction (inbound/outbound)
• Call routing and forwarding data
• Voicemail indicators and call disposition data

2.3 SMS and Message Data

When SMS or MMS messages are sent or received through the Services, we collect:

• Sender and recipient phone numbers
• Message content and timestamps
• Delivery status and carrier metadata
• Opt-in and opt-out records

2.4 Voicemail and Transcription Data

If voicemail features are enabled, we collect and store voicemail audio recordings and, if transcription is enabled, the text transcriptions of those recordings. AI-generated summaries of voicemails may also be stored.

2.5 Usage and Technical Data

We automatically collect certain technical information when you use the Services, including:

• IP address, browser type, and operating system
• Pages visited, features used, and time spent on the platform
• Device identifiers and session tokens
• Error logs and diagnostic data

2.6 Cookies and Analytics

We use cookies, web beacons, and similar tracking technologies to enhance your experience and analyze usage patterns. You may control cookie preferences through your browser settings, though disabling cookies may affect certain features of the Services.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Services;
• Process transactions and manage your subscription;
• Send transactional and account-related communications (billing, service updates, security alerts);
• Enable AI-powered features such as voicemail transcription, call summaries, and missed-call auto-replies;
• Monitor and analyze usage to improve platform performance and user experience;
• Detect, investigate, and prevent fraudulent transactions, abuse, and security incidents;
• Comply with legal obligations and respond to lawful government requests;
• Enforce our Terms of Use, Acceptable Use Policy, and other agreements.

We do not sell your personal information to third parties for their marketing purposes.

4. AI Processing and Automated Features

ExtenX offers AI-powered features that process your communications data. You acknowledge and agree that:

• Voicemail Transcription: Voicemail audio may be processed by automated speech recognition systems, including third-party AI providers, to generate text transcriptions.
• AI Summaries: AI systems may analyze voicemail content to generate brief summaries. These summaries may contain inaccuracies and should not be relied upon as verbatim records.
• Missed-Call Auto-Reply: Automated messages may be sent to callers on your behalf using AI-assisted templates. You are responsible for the content of automated messages sent from your account.
• AI-Generated Content: Communications generated or assisted by AI tools are provided for convenience. ExtenX does not warrant the accuracy, completeness, or appropriateness of AI-generated content.

Communications data processed by AI features may be used to improve AI model performance, subject to applicable data processing agreements and privacy protections.

5. Third-Party Providers

To provide the Services, we share certain data with trusted third-party service providers, including:

• Twilio, Inc.: Our primary telecommunications infrastructure provider. Call metadata, SMS message data, and phone number information is processed through Twilio's systems. Twilio may retain communication metadata in accordance with its own privacy policy and regulatory obligations.
• Payment Processors: We use third-party payment processors (such as Stripe) to handle billing. Your payment card data is processed directly by our payment processor and is subject to their privacy policy.
• AI Providers: Certain AI features may be powered by third-party AI platforms. Data shared with AI providers is governed by applicable data processing agreements.
• Analytics Providers: We use analytics tools to understand how users interact with the Services. Analytics providers may collect usage data subject to their own privacy policies.
• Cloud Infrastructure: The Services are hosted on cloud infrastructure provided by third-party hosting providers.

We require all third-party providers to maintain appropriate security and confidentiality protections for data they process on our behalf.

6. SMS Consent and Messaging Disclosures

ExtenX is a platform provider. When you use our Services to send SMS messages to your own customers or contacts:

• You are responsible for obtaining all legally required consents from your message recipients before sending SMS communications;
• ExtenX does not collect or manage consent records on behalf of your message recipients — that responsibility belongs to you;
• SMS opt-out requests (STOP) from your contacts must be honored promptly;
• Message and data rates may apply to recipients of SMS messages sent through the Services.

If ExtenX sends you SMS messages related to your account (service notifications, alerts), you may opt out by replying STOP to any such message or by updating your notification preferences in your account settings.

7. Data Sharing and Disclosure

We do not sell personal information. We may share your information in the following limited circumstances:

• Service Providers: With trusted vendors who assist in operating the Services, as described in Section 5;
• Legal Requirements: When required by law, court order, or lawful government request (see Section 14);
• Protection of Rights: To protect the rights, property, or safety of ExtenX, our users, or others;
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity subject to the same privacy protections;
• With Your Consent: With your explicit consent for purposes not described in this policy.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Services. After account termination, we may retain certain data for a reasonable period to:

• Comply with legal obligations;
• Resolve disputes and enforce agreements;
• Maintain business records for regulatory purposes.

Call metadata, SMS logs, and voicemail data may be retained for a period determined by applicable telecom regulations and our data retention schedule. You may request deletion of your personal data subject to our legal obligations and the rights described below.

9. Security Practices

We implement commercially reasonable technical and organizational security measures to protect your information from unauthorized access, disclosure, alteration, or destruction. These include encryption of data in transit and at rest, access controls, and regular security assessments.

However, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach affecting your rights, we will notify you as required by applicable law.

10. Customer Responsibilities

• Providing your own customers with a privacy notice disclosing your data practices;
• Obtaining all required consents for SMS, voice, and other communications;
• Complying with applicable privacy laws (CCPA, GDPR, TCPA, etc.) with respect to your customers' data;
• Responding to your customers' privacy rights requests;
• Ensuring that communications sent through ExtenX on your behalf comply with applicable law.

ExtenX processes your customers' data solely as a service provider acting on your instructions and is not responsible for your independent privacy obligations to your customers.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at [email protected]. We will respond to verifiable consumer requests within 45 days as required by law.

12. International Users and GDPR

ExtenX is operated from the United States. If you access the Services from outside the United States, your information may be transferred to and processed in the United States, which may have different data protection laws than your country.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal bases: performance of a contract, compliance with legal obligations, our legitimate interests, or your consent. You have rights under the GDPR including access, rectification, erasure, restriction, data portability, and the right to object to processing. To exercise these rights, contact us at [email protected].

13. Children's Privacy

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete such information. If you believe a child has provided us with their information, please contact us at [email protected].

14. Legal Compliance and Law Enforcement

We may disclose your information, including call records and message content, to law enforcement, government authorities, or other third parties when:

• Required by applicable law, regulation, or legal process;
• Responding to a valid court order, subpoena, or search warrant;
• Necessary to protect the safety of any person or to address fraud or security issues;
• Required to comply with telecommunications regulations, including lawful interception requirements.

Where permitted by law, we will attempt to notify you of such requests before disclosing your information.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our website. The "Last Updated" date at the top of this policy reflects the most recent revision. Your continued use of the Services after changes are posted constitutes your acceptance of the updated policy.

16. Contact Information

For privacy-related questions, requests, or concerns, please contact us at:

ExtenX — Privacy Team
Email: [email protected]
Website: extenx.com