OnHand Voice privacy policy

Last updated: 17 October 2026

OnHand Voice ("the app") is a Shopify app published by Elektraset, s.r.o. ("we", "us"). It answers phone calls for Shopify merchants with information from their Shopify store. This policy explains which data the app processes, why, and for how long. Contact: help@elektraset.com.

Who is responsible

• For the merchant's store data and for the app account, we are the controller.
• For data about the merchant's callers and customers, the merchant is the controller and we process it on the merchant's behalf (as a processor) only to provide the app.

Data we process

From the merchant's Shopify store (through the Shopify Admin API, read-only):

• shop name, currency, time zone and plan type;
• products, variants, SKUs, vendors, product types, tags, prices, and available inventory per location;
• locations (name and address);
• orders, only when a caller asks for an order status: order number, dates, payment and fulfillment status, tracking company and number, and the phone numbers on the order. Phone numbers are used only to verify the caller and are not stored by the app.

From phone calls (through the merchant's own Twilio account):

• the caller's phone number (caller ID);
• the transcript of what the caller said (speech recognition by Twilio) and the agent's answers;
• the call duration and outcome, and an estimate of the Twilio cost;
• if the merchant turns recording on: a recording of the call, stored in the merchant's Twilio account. Every recorded call starts with a recording notice. The app stores only the recording reference and streams the audio to the merchant on request;
• voicemails that callers leave (stored in the merchant's Twilio account).

From the merchant: the rules and answers they write in the app, their transfer phone number, and their Twilio Account SID and Auth Token (the token is encrypted at rest with AES-256-GCM).

We do not use cookies for tracking, we do not sell data, we do not use the data to train AI models, and we do not show advertising.

Why we process it (legal bases)

• To provide the app to the merchant (contract): answering calls, test calls, call log, transfers, voicemail, billing limits.
• To keep the app secure and working (legitimate interest): logs, abuse prevention, verifying Twilio and Shopify request signatures.
• Callers' data is processed on the merchant's instructions; the merchant is responsible for informing callers and, where required, obtaining consent (for example for recording).

Who receives data (sub-processors)

• Shopify (the platform the app runs on) – store data and billing.
• Twilio Inc. – telephony, speech recognition and text-to-speech, in the merchant's own Twilio account under the merchant's agreement with Twilio.
• Our hosting provider – the app server and database that run the app.

How long we keep data

• Call records, transcripts and unanswered questions: while the app is installed. The merchant can ask us to delete them at any time.
• When the merchant uninstalls the app, the Twilio credentials are deleted at once; all other store data is deleted when Shopify sends the shop redaction request (48 hours after uninstalling).
• When Shopify sends a customer redaction request, we delete the calls from that customer's phone number.
• Recordings and voicemails stay in the merchant's Twilio account under the merchant's control.

Your rights

Under the GDPR and similar laws you can ask for access, correction, deletion, restriction, portability, or object to processing. Callers and customers should contact the merchant first; we help the merchant answer such requests (Shopify sends them to us as customers/data_request and customers/redact). You can also contact us at help@elektraset.com and complain to your data protection authority.

Security

Data travels over HTTPS. Twilio and Shopify webhooks are verified by their signatures. Twilio Auth Tokens are encrypted at rest. Access to production systems is limited to the staff who operate the app.

International transfers

Shopify and Twilio may process data outside your country, including in the United States, under their own safeguards (such as Standard Contractual Clauses).

Changes

We will post changes on this page and update the date above.

Contact

Elektraset, s.r.o. – help@elektraset.com – https://elektraset.com/