Privacy Policy
Last updated: 2026
Who This Policy Covers
We build and operate AI systems in two different situations, and this policy applies differently to each.
When you deal with TONNIC directly. If you visit our website, contact us, use our chatbot, or call our own line at 1-888-442-BUZZ (1-888-442-2899), TONNIC decides why and how your personal information is handled, this policy governs, and we are accountable for it.
When you deal with a system we built for a client. Much of what we build runs for our clients, under their brands, phone numbers, and accounts. If you call, text, or chat with one of those systems, our client decides why and how your information is handled and is accountable for it. We act only on that client's instructions. Their privacy policy governs, not this one, and requests about your information should go to them. We will help our client respond.
Acting on a client's instructions does not reduce our own obligations. We remain responsible for safeguarding information while it is in our custody, for limiting who can reach it, and for telling the client promptly if something goes wrong.
Where an engagement calls for it, we sign a separate data processing agreement with the client, and that agreement prevails over this policy for the information it covers.
1. Information We Collect
Personal Information
- Contact Details: Name, email address, phone number, and other details you provide when filling out forms, signing up for communications, or using our AI/chatbot services
- Business Information: Company name, role/title, or other relevant corporate details (if applicable)
Voice & Call Data (Important Notice)
This section describes calls to TONNIC's own line. For calls to a system we operate on a client's behalf, see Who This Policy Covers above.
- Voice Recordings: Calls to our own line are recorded and processed for service delivery, quality assurance, and record-keeping
- Call Metadata: Phone numbers, call duration, timestamps, call routing information, and caller ID details
- Conversation Transcripts: AI-generated text transcriptions for analysis and record-keeping
- Voice Patterns: Voice characteristics and patterns may be analyzed for service optimization (not used for biometric identification)
- AI Platform Providers: Voice data is processed by our voice and telephony providers, currently Retell and Twilio, under contractual confidentiality and data protection obligations
We do not use voice recordings, transcripts, or personal information to train or fine-tune AI models. Our voice providers operate under their own terms and data processing agreements, and some may use data to improve their own models. Where an engagement requires that no provider trains on the data, we configure it that way and confirm it with you in writing.
Digital Interaction Data
- Website Usage: IP address, browser type, device type, operating system, pages visited, timestamps, and navigation patterns
- Chatbot Interactions: All messages, queries, and responses from AI chatbot conversations on our website
- Cookies & Tracking: Session cookies, preference cookies, analytics cookies, and similar tracking technologies
Payment & Transaction Data
Payment details are collected and processed by trusted third-party payment processors. We do not store full payment card details on our servers. Transaction records and billing information are retained for accounting and legal purposes.
2. How We Use Your Information
Voice Services & AI Operations
- Service Delivery: Provide AI voice agent services, handle inquiries, and process voice-based requests
- Quality Assurance: Monitor call quality, review conversations, and ensure service standards are met
- Analytics: Generate aggregate insights for business and service improvement
- Compliance: Maintain records for regulatory compliance and dispute resolution
No AI model training. We do not use personal information, voice recordings, or transcripts to train or fine-tune AI models, whether identified, de-identified, or anonymized.
- Service Delivery: Provide, maintain, and enhance all our AI-driven solutions, phone-based services, and digital offerings
- Communication: Send service notifications, respond to inquiries, and with consent, send marketing communications (CASL compliant)
- Personalization: Customize user experiences and optimize our services based on usage patterns
- Legal Compliance: Meet legal, regulatory, or law enforcement requirements and protect our rights
3. AI Service Providers & Third-Party Sharing
AI Platform Partners
We work with AI and telephony service providers who process voice data under contractual obligations:
- Retell: Voice AI infrastructure and real-time conversation handling
- Twilio: Telephony, call routing, and messaging
These providers process data on our instructions under their own terms and data processing agreements. Some provider terms permit them to use data to improve their own models. Where an engagement requires that no provider trains on the data, we configure it that way and confirm it in writing. Where a system runs in a client's own platform accounts, that client's agreements with those providers govern instead. We may use other providers on a specific engagement, and we will tell you which on request.
- Service Providers: Hosting, analytics, payment processing, and technical infrastructure providers
- Business Transactions: Information may be transferred in mergers, acquisitions, or asset sales with equivalent privacy protections
- Legal Requirements: Disclosure when required by law, court order, or to protect legal rights
4. Data Retention & Storage
Voice Data Retention Schedule
- Voice Recordings: Up to 2 years, for quality assurance and record-keeping
- Call Transcripts: Up to 2 years, for analysis and record-keeping
- Call Metadata: Up to 3 years, for business and compliance purposes
- Personal Information: Retained as long as necessary for service delivery and legal requirements
Where a system runs on a client's behalf, retention is set by that client and by the platforms in their accounts, not by this schedule.
You may request earlier deletion of your voice data by contacting hello@tonnic.ai
Regulated and Sensitive Information
Some engagements involve health information, information about children, financial information, or other categories carrying additional legal obligations. Where that is the case:
- Handling is agreed with the client in writing before work begins, including where data may be stored, who may access it, which subprocessors may be used, and how long it is kept.
- That written agreement prevails over this policy for the information it covers.
5. Canadian Legal Basis (PIPEDA & CASL)
Under PIPEDA, we collect, use, and disclose personal information with appropriate consent or as otherwise permitted by law:
- Implied Consent: For clearly communicated purposes when you voluntarily provide information
- Express Consent: Required for voice recording and marketing communications (CASL compliant)
- Withdrawal Rights: You can withdraw consent at any time (may limit service access)
Many of our clients and their customers are in the United States, where recording and messaging consent requirements vary by state, including states that require all parties to a call to consent. Where we operate a system on a client's behalf, meeting those requirements is the client's responsibility, as set out in the Voice Data Notice in our Terms of Service. We will build in whatever disclosure or consent step the client asks for.
6. Your Rights & Choices
Voice Data Rights
These rights apply to data we hold as our own, which means calls to TONNIC's own line and your dealings with us directly. For a system we operate on a client's behalf, the client decides these requests, so send them to that client and we will help them respond.
- Access: Request copies of your voice recordings and transcripts
- Deletion: Request deletion of your voice recordings and related data
- Opt-Out: Stop using voice services to prevent future voice data collection
- Correction: Request correction of inaccurate transcripts or personal information
- Marketing Opt-Out: Unsubscribe from emails or SMS by following unsubscribe instructions
- Cookie Management: Control cookies through browser settings (may affect functionality)
- Complaint Rights: Contact Privacy Commissioner of Canada if concerns are not resolved
7. International Transfers & Security
We implement industry-standard security measures to protect your data. While our operations are primarily in Canada, some AI service providers may process data outside Canada. We ensure appropriate safeguards through contractual protections and compliance with Canadian privacy requirements.
8. Children's Privacy
Our own website, chatbot, and voice line are intended for adults. We do not knowingly collect personal information from children through them. If you believe we have, contact us and we will delete it.
Systems we build for clients are a different matter. Some of our clients deliver services to children and families, and a system we operate on their behalf may handle information about a child. In those engagements our client is accountable for that information, we act only on their instructions, and handling is agreed in writing before work begins as described under Regulated and Sensitive Informationabove. Requests about a child's information held in one of those systems should go to that client, and we will help them respond.
9. Policy Updates
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be posted with an updated "Last Updated" date. Continued use of our services after updates constitutes acceptance of the revised policy.

