When a customer leaves their name and number with your AI receptionist, that information lands on somebody's server. Under Canadian law, what happens to it next is your problem, not your vendor's. Here is what actually gets stored and the questions that get you a straight answer.
We build software, we are not lawyers, and nothing here is a legal opinion. This is a plain-language map of the questions worth asking. If you handle health information, legal files or anything in Québec, get actual advice — the rules are stricter than most people assume.
Canada's federal private-sector privacy law, PIPEDA, has a feature that surprises people: when you hand personal information to a supplier to process on your behalf, you remain accountable for it. Transferring the data does not transfer the responsibility.
Your AI receptionist vendor is your processor. The caller's name, phone number and the reason they called are personal information that you collected, through a tool you chose. If that vendor stores it badly, or in a jurisdiction you never disclosed, or keeps it for five years after you cancel, the obligation to your customer is still yours. Alberta and British Columbia have their own provincial equivalents, Québec's Law 25 is stricter again, and if you are a health provider you have a whole separate layer on top.
None of this makes voice AI a bad idea. It just means "we use enterprise-grade security" is not an answer to any of the questions below.
It helps to know the shape of the thing. A single answered call can generate up to six distinct artefacts, and vendors differ on which ones they keep:
Then note that a voice agent is not one service. It is a stack: a telephony provider carries the call, a speech-recognition service turns audio into text, a language model decides what to say, a text-to-speech service says it, a database stores the result. That is five companies minimum, each in some country, each with its own retention policy. "Where does my data live" is genuinely five questions, and a vendor who answers with one country name has probably not checked.
Not the head office. The database. Many vendors selling to Canadian businesses run entirely in US regions, which is lawful if disclosed but is something you should know rather than discover.
ZoiVox: our database runs in a Canadian region. That covers the bookings, the contact details and the call records — the data you would actually be asked about.
Ask it as two questions, because the answers are often different: is there a recording at all, and what is the retention period. Then ask the follow-up that matters most — can I turn it off, and can I delete a specific call?
Recording also has its own legal wrinkle. In Canada, recording a conversation you are party to is generally lawful under the Criminal Code's one-party consent rule — but that is the criminal question, and it is not the privacy question. PIPEDA still expects you to tell people you are collecting their personal information and why. Those two things get conflated constantly, including by vendors.
ZoiVox: we do not record calls. We keep the text transcript and the written summary, never the audio — which is why the summary is the record you get emailed after every call. The full position is in our privacy policy.
Ask about the vendor and about every provider underneath them, because the answer can differ at each layer. Get it in writing in the contract, not in an email. "We don't train on customer data" is a common and usually honest claim, but it is worth having in a document you could point at later.
Two sub-questions, and the second is the one people forget:
ZoiVox: there is an export button in the dashboard that produces your records as CSV files, and the right to it is written into our terms rather than being a favour.
Under PIPEDA an individual can ask you what personal information you hold about them. If a customer does that and the answer involves a support ticket to your vendor and a week of waiting, you have a problem that is formally yours. You want to be able to look it up yourself.
If you want a short version to take into a sales call, these are a fair bar, and they are specific enough that vague answers become obvious:
Notice that none of these is about encryption. Everyone says they encrypt things and almost everyone does; it has stopped being a differentiator and it was never the thing most likely to go wrong. Retention, location and deletion are where the real variation is.
Being straight about this: a small vendor — us included — is a greater concentration of risk than a large one, simply because there are fewer people and less formal process. What a small vendor can offer instead is that you can get a direct answer from someone who actually knows, and that the whole stack is small enough to be described honestly on one page.
So hold us to the list above. If you ask us one of these five questions and get something evasive, that is information about us, and you should use it.
Related: nine questions to ask before you let AI answer your phone, which covers the operational side — hallucinations, transfers, languages and what a bad month costs.
Talk to ZoiVox in your browser, or email a question straight to a human.