VMAlertsVMAlerts is a voicemail notification service operated by J. Riggin & Associates, Inc. (“we”, “us”). This policy explains what personal data the service handles, why, and who else touches it.
Our role
Our clients are businesses that use VMAlerts to route their own voicemail to their own staff. Those clients are the controllers of the personal data involved. We are a processor: we handle that data only to deliver the service, on their instructions, and we do not decide what it is used for.
If you left a voicemail for one of our clients and want to know how your data is handled, the client is the right party to ask. See Data subject requests.
What we process
For each voicemail the service handles:
- the voicemail audio as recorded by the client's phone system
- a machine-generated transcript of that audio
- the calling number (caller ID) as presented by the carrier
- the called extension — the mailbox the message was left in
- the timestamp of the message
That is the whole set. We collect it for one purpose: to deliver the message, and notice of it, to the person the client has designated to receive it. We do not collect it for any other purpose, and we do not enrich it with data from anywhere else.
A voicemail may contain anything the caller chose to say. We do not control that, and neither the audio nor the transcript is inspected by us in the ordinary course of running the service.
Sub-processors
Three, and no others.
| Sub-processor | What it does |
|---|---|
| Telnyx | Carries the telephone calls and the text messages |
| ElevenLabs | Speech-to-text transcription of voicemail audio |
| IONOS | Hosts our own mailboxes, so it holds mail sent to us |
Telephony and text messaging
Telnyx is our carrier. Both the incoming call on which a voicemail is left and the outgoing calls the service places to agents pass through them, so — as with any telephone carrier — they handle the calling number, the number called, and the audio of the call itself while it is in progress.
Where a client has turned on text notification, the message is sent through Telnyx. That message contains the caller's number and the transcript. If it is sent as a picture message, Telnyx additionally fetches the recording from our server over HTTPS, and that published copy is deleted as soon as delivery is confirmed, or within 24 hours regardless.
Their privacy policy is at telnyx.com/privacy-policy.
Transcription
Voicemail audio is sent to ElevenLabs to produce the transcript. They are our only sub-processor that holds a copy of voicemail content at rest.
We have opted the account out of ElevenLabs' use of submitted data for training or improving their models, so voicemail audio and transcripts are not used for that purpose.
We do not use their Zero Retention Mode, which is available only to enterprise accounts, so audio and transcripts may be retained on ElevenLabs' own systems under their retention terms. Their privacy policy is at elevenlabs.io/privacy-policy.
Notification email goes from our own mail server directly to the recipient's mail provider. We use no third-party sending service, so no email vendor holds a copy. The consequence is that the notification — including the transcript, and the audio where it is attached — is handed to whatever provider the client's recipient uses, and we have no control over what that provider retains.
Our own mailboxes, including support@vmalerts.jraphones.com, are
hosted by IONOS. IONOS holds mail sent to us, such as a support
request and anything attached to it. It is not involved in delivering
notifications.
Retention
Voicemail audio and transcripts are deleted 30 days after the message is received. The clock runs from when the caller hung up, not from when anyone read it.
That covers every copy the service holds:
- the message in its mailbox on our telecommunication systems
- the working copy taken to place the calls and produce the transcript
- the transcript stored in the service database
- the archive written when a profile is deleted
Audio published so a voicemail can be sent as a picture message is deleted within 24 hours, not 30 days.
What we keep beyond 30 days is the call record: the extension, the calling number, the timestamp, the outcome, and which agent accepted. That is the client's own call history and their reports are built on it. It holds no audio and no transcript.
There is no off-site CRM and no data warehouse. The service itself carries no third-party analytics; the public marketing pages do, and that is described under Website analytics.
The 30-day period is a setting, not a hard limit. A client who needs a shorter one should tell us.
Website analytics
Some pages of this website carry the LinkedIn Insight Tag: the home page (in English, French and Spanish), the introductory video page, the sign-up form, and the confirmation page shown after a completed payment. They are the pages our LinkedIn advertising points at or leads to, and the tag is how we tell whether those adverts are working — including whether a visit ended in a sign-up.
It runs only on those public pages. It is not on the console, not on this policy page, and it never sees voicemail audio, transcripts, caller numbers or anything else described above. On the confirmation page the address is shortened before the tag loads, so LinkedIn does not receive the private link that page is opened with.
What LinkedIn receives is ordinary website-visitor data: your IP address, browser and device, the page you landed on, and a cookie it may set or read. If you have a LinkedIn account it may associate the visit with it. LinkedIn decides how it uses that data, as its own controller rather than on our instructions — their privacy policy is at linkedin.com/legal/privacy-policy, and it is also where you opt out of their advertising tracking. Browser-level tracking protection, or a blocker, stops it too; the pages work normally without it.
We use it to count visits and measure advert performance. We do not use it to build audiences, and we do not combine it with any client's voicemail data.
Free trial sign-up and demo requests
When someone signs up for a free trial we collect their name, company, email address and mobile number. We send a one-time verification code to the email address and another by text message to the mobile number, to confirm them.
If someone requests a live demo, or asks to be told when a program for Mexico is ready, we collect only their email address. We use it only to arrange that call or to send that one notice.
When a trial ends without the customer keeping the account, we keep their settings for 14 days. After that the settings are archived and the phone number is released.
What we do not do
The voicemail data described above — the audio, transcripts, caller numbers, extensions and timestamps — is never used for anything beyond delivering the message. Specifically, we do not:
- sell personal data, or share it for anything resembling a sale
- use it for advertising, profiling or audience building
- use it to train machine learning models — not our own, and not our transcription provider's, which we have opted out of
- disclose it to anyone beyond the three sub-processors named above and the mail provider the client's own recipient uses
The single exception is disclosure we are legally compelled to make: a valid court order, subpoena, or equivalent legal process. Where we are permitted to tell the client that such a demand has been made, we will.
Security
- Endpoint protection. CrowdStrike Falcon runs on the servers that operate the service.
- Encryption in transit. The web console and the transcription API are reached over TLS. Notification email is delivered with opportunistic TLS where the receiving mail server offers it, which is not something we can guarantee on the recipient's behalf.
- Access control. Console accounts are scoped to a single client's data. Our own administrative access is limited to named staff and is used for operating and supporting the service.
- Network controls. The servers sit behind a firewall that exposes only the ports the service needs, with automated blocking of repeated failed authentication attempts.
- Least-privilege credentials. The transcription API key is scoped to transcription alone and cannot read or change the account it belongs to.
No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, please write to the address below.
Data subject requests
Because we act as a processor and not a controller, we do not respond directly to requests to access, correct, delete, or export personal data. Those requests go to the client whose voicemail system holds the data — they are the controller and the decision is theirs.
If you contact us instead, we will tell you so, and where we can identify the client concerned we will refer you to them. When a client asks us to act on such a request, we carry it out on their instruction.
Changes to this policy
When this policy changes we update the date at the top. Where a change materially affects how client data is handled, we notify our clients directly rather than relying on them to notice a new date here.
Contact
J. Riggin & Associates, Inc.3339 Briarwood Circle
Safety Harbor, FL