Privacy Policy

PILOTLAB LLC dba VM HUNTER ("VM Hunter", "we", "us") operates the answering machine detection service, the website at vmhunter.com and the customer portal (together, the "Service"). This policy explains what personal data we handle, why, who we share it with and the choices you have.

We handle personal data in two different roles, and the difference matters:

• As a controller for data about our own customers and website visitors: account details, billing records, sign-in logs, support messages and website analytics.
• As a processor for call data our customers send us. When a customer's dialer streams the first seconds of a call to us, that customer decides why and how the data is used; we process it only to return a detection result and to show the customer their own logs. See GDPR & Data Processing.

We do not sell personal data, and we do not use call data for advertising.

The Service works by analysing the first seconds of audio after a call is answered. For each call we keep a short audio sample, its transcript and the result, so that you can review and audit detections in your portal. Recordings are available only to the account that made the call and to our authorised staff, through authenticated or signed, expiring links.

You control this data from your portal:

• Delete a recording from the call log, or delete all recordings from Settings. Deleted audio cannot be recovered.
• Turn recording storage off in Settings. Calls are still analysed in real time, but no audio sample is written to disk; the transcript and result are kept so your logs and usage remain accurate.

Your responsibilities as our customer. You control which calls are sent to us. You are responsible for having a lawful basis to place those calls and to have the opening seconds analysed and recorded, for giving any notice or obtaining any consent that call-recording, wiretapping, telemarketing or privacy law requires in the places you call, and for honouring do-not-call rules. See our Acceptable Use Policy.

We share personal data only with providers that help us run the Service, under contracts that limit what they may do with it:

• Payment processing: Stripe, for subscriptions, invoices and card payments.
• Speech recognition infrastructure: a cloud speech-processing provider that converts the audio sample to text in real time on our behalf.
• Transactional email delivery: an email service provider, for account, usage and security messages.
• Hosting and data centre: the provider of the servers the Service runs on, located in the United States.
• Analytics: Google Analytics, only if you consent to analytics cookies.

We may also disclose data where the law requires it, to protect our rights or the safety of others, or to a successor in a merger, acquisition or sale of assets, subject to this policy. A current list of sub-processors for customer call data is available to customers on request.

We operate from, and store data in, the United States, and some of our providers process data in other countries. Where personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant) or another lawful transfer mechanism.

We protect data with measures appropriate to the risk, including:

• TLS encryption for the website, the customer portal and all account and billing traffic.
• Passwords stored only as salted bcrypt hashes; session cookies that are HTTP-only and sent only over HTTPS.
• Per-account API keys that can be deactivated at any time, and plan-level rate limits.
• Call recordings served only to the owning account or through signed links that expire.
• Access to production systems restricted to authorised personnel, and logs of sign-ins and administrative actions.

Audio is streamed from your dialer to our detection endpoint over a WebSocket connection. If your security policy requires transport encryption or a private network path for the audio stream, contact us before sending production traffic so that we can agree a suitable setup.

No system is perfectly secure. If we become aware of a personal data breach affecting you, we will notify you and the competent authorities as the law requires.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to certain processing, and to withdraw consent at any time without affecting processing that already took place. Residents of the EEA, UK and Switzerland can find the detail in GDPR & Data Processing.

California residents: you have the right to know what personal information we collect and how we use and disclose it, to request deletion and correction, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising.

To exercise any right, email support@vmhunter.com from the address on your account. We respond within 30 days. If a request concerns call data that one of our customers sent us, we will refer you to that customer, who decides how that data is used.

We use a small number of essential cookies to keep you signed in and remember your choices, and analytics cookies only with your consent. The full list and your controls are in our Cookie Policy.

The Service is for businesses. It is not directed at children, and we do not knowingly collect data from anyone under 16.

We will post any changes on this page and update the date at the top. If a change materially affects how we use your data, we will notify account holders by email before it takes effect.

Questions, requests or complaints about privacy: