Privacy Policy

Fonema Inc. (hereinafter, "Fonema", "we" or "the Controller") Commercial brand: Fonema — website www.fonema.ai

Last updated: June 17, 2026 · Version: 3.1 (global)

1. Identity and contact details of the controller

Controller: Fonema Inc., a company incorporated in the State of Delaware, USA (EIN 36-5131969). Address: 131 Continental Dr, Ste 305, Newark, DE 19713, USA. Privacy contact email: privacy@fonema.ai Website: www.fonema.ai

Fonema Inc. determines the purposes and means of processing the personal data described in this Policy and acts as the Controller. For clients contracting through Fonología, S.A. de C.V. (Mexico), jurisdiction-specific conditions are governed by Annex D of the Master Services Agreement (see Section 16, "Entity notice").

2. Scope and legal framework

This Policy applies globally to the personal data we process through the fonema.ai site, the Dashboard, our APIs and our services. Depending on the data subject's location, we give effect to applicable law, including:

• Mexico — Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations and ARCO rights.
• European Union / EEA and United Kingdom — General Data Protection Regulation (GDPR / UK GDPR).
• California, USA — California Consumer Privacy Act, as amended by the CPRA (CCPA).
• Other privacy laws applicable in the jurisdictions where we operate.

Where a local provision grants greater rights to the data subject, that provision shall prevail.

3. Roles in processing

Fonema acts in different roles depending on its relationship with the data subject:

a) As Controller: when we process data for our own purposes, e.g. users of the fonema.ai site and contact forms, sales prospects, Dashboard users, employees, vendors and candidates.

b) As Processor: when we process personal data on behalf of and under the instructions of a client that uses the platform to operate voice, WhatsApp or other agents. In these cases the client is the controller vis-à-vis end users, and Fonema processes data solely under the Master Services Agreement (MSA) and the Data Processing Addendum (DPA).

4. Personal data we collect

When we act as Controller (site, prospecting, Dashboard):

• Identification data: name, job title, company, official ID where applicable.
• Contact data: email, phone number, business address.
• Academic and employment data: for candidates only.
• Authentication data: username, encrypted password, multi-factor authentication factors.
• Navigation and device data: IP address, session identifiers, browser type, operating system, language, region, timestamps, cookies and similar technologies.
• Financial and tax data: only when the data subject is a contractual counterparty (billing).

When we act as Processor (operating AI agents for clients):

• End-user identification and contact data: name, phone, email.
• Communication content: call recordings, transcripts, WhatsApp messages or other channels operated by the agent.
• Interaction metadata: date, time, duration, channel, outcome, routing, operational tags.
• Contextual data provided by the client integrated with the platform to personalize the conversation.

Sensitive data: as a general rule, Fonema does not collect sensitive personal data for its own purposes. Minors: Fonema does not direct its services to persons under 18 and does not knowingly collect their data.

5. Purposes of processing

5.1 Primary purposes

Enable access to and operation of the Dashboard and API; provide, maintain and secure the platform; handle requests, demos and onboarding; formalize and perform the contract (billing, collections, support); comply with legal obligations; and communicate about the service, incidents and updates.

5.2 Secondary purposes (non-essential)

Only for prospects, clients or Dashboard users: marketing communications and product news, aggregate statistical analysis, satisfaction surveys, and success stories or testimonials (with prior express authorization). You may object at any time by writing to privacy@fonema.ai.

5.3 No AI training by default

Fonema does not use the content of conversations, transcripts or recordings to train general-purpose or public AI models. Processing by AI models is performed solely to deliver the service instructed by the client (inference), in accordance with the AI Transparency Policy. Use of Google Workspace APIs for calendar and email integrations is solely to enable those features and not to train models.

6. Legal bases for processing

We process personal data on one or more of the following bases: (i) performance of a contract or pre-contractual measures; (ii) the data subject's consent; (iii) legitimate interest in operating, securing and improving the platform; and (iv) compliance with legal obligations. Where consent is the basis, you may withdraw it at any time without affecting the lawfulness of prior processing.

7. Transfers and sub-processors

To provide the service we transmit personal data to providers acting as processors / sub-processors under confidentiality, security and purpose-limitation obligations. The current list is available at fonema.ai/legal/sub-procesadores.

Data is stored primarily in the United States (AWS, us-east-1 by default). For transfers from the EU/EEA or the United Kingdom, Fonema uses Standard Contractual Clauses (SCCs) or the IDTA plus additional technical safeguards (encryption, restricted access). We provide at least 30 calendar days' prior notice before adding a new sub-processor, with the right to object described in the DPA.

8. Your rights

Depending on your jurisdiction, you have the following rights:

Mexico (LFPDPPP — ARCO rights): Access, Rectification, Cancellation and Objection; withdrawal of consent; and limitation of use or disclosure. Response time: 20 business days. You may also contact INAI (www.inai.org.mx).

European Union / EEA / United Kingdom (GDPR): access, rectification, erasure ("right to be forgotten"), restriction, portability and objection; withdrawal of consent; and the right to lodge a complaint with your supervisory authority.

California (CCPA/CPRA): to know, delete and correct your data; to opt out of the "sale" or "sharing" (Fonema does not sell personal data); and not to be discriminated against for exercising your rights.

How to exercise your rights: send your request to privacy@fonema.ai. We may request identity verification. Exercising your rights is free, except for shipping or certified reproduction costs where applicable.

9. Data retention

Once the periods elapse, data is irreversibly deleted or anonymized.

10. Security measures

We implement reasonable administrative, technical and physical measures: encryption in transit (TLS 1.2+) and at rest (AES-256) on certified providers' infrastructure (SOC 2 Type II / ISO 27001); access control on a least-privilege basis with mandatory MFA and audit logs; pseudonymization and minimization; staff training; and an Incident Response Plan with an active Cyber Liability policy. In the event of a significant breach, we notify affected data subjects and clients with a preliminary notification within 24 hours and a final one within 72 hours, as well as the authorities where required by law.

11. Tracking technologies (cookies)

The site and Dashboard use cookies and similar technologies to maintain the session, remember preferences (language, region), measure usage and performance (e.g., Google Analytics) and optimize campaigns. You can disable cookies in your browser; some Dashboard features may be affected.

12. Artificial intelligence transparency

Fonema operates an AI agent platform. End users are informed at the start of the interaction that they are speaking with an automated system, and decisions with legal or significant effects are not made solely on an automated basis without human oversight. More details at fonema.ai/legal/transparencia-ia.

13. Minors

Fonema does not direct its services to persons under 18. If a guardian identifies that a minor provided data, they should notify privacy@fonema.ai for deletion.

14. Changes to this Policy

This Policy may be amended for legal, operational or technological reasons. Amendments will be posted at fonema.ai/politica-de-privacidad indicating the last-updated date; substantive changes will be notified by email or via a notice in the Dashboard.

15. Contact

Privacy — Fonema Inc. 131 Continental Dr, Ste 305, Newark, DE 19713, USA. Email: privacy@fonema.ai

16. Entity notice

Fonema is the commercial brand operated by two companies of the same group: Fonema Inc. (Delaware, USA; EIN 36-5131969), Controller for the processing described in this Policy and contracting entity for clients in the United States; and Fonología, S.A. de C.V. (Mexico), contracting entity for clients in Mexico. The counterparty and the specific applicable conditions depend on the jurisdiction in which you contract, per Annex D of the Master Services Agreement. Questions: legal@fonema.ai.

Related documents: Terms & Conditions · Acceptable Use Policy · Sub-Processors · AI Transparency · Public SLA