Privacy Policy

1. Introduction

InCoko ("we," "us," or "our") is a Conversational AI Studio operated by Biz Digital IT. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform to create, test, and deploy voice AI agents.

By accessing or using InCoko, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the platform.

2. Information we collect

Account Information

Name, email address, workspace name, and authentication credentials managed through AWS Cognito.

Voice Call Data

Call recordings, transcripts, call duration, caller phone numbers, and AI-generated call insights (summaries, sentiment, topics, action items).

Agent Configuration

Business knowledge bases, agent behavior settings, greeting scripts, call flows, evaluation criteria, and industry-specific content you provide.

Appointment & Campaign Data

Appointment details, campaign leads (names, phone numbers, custom fields), qualification results, and scheduling preferences.

Usage Data

Pages visited, features used, agent performance metrics, and analytics data.

Technical Data

IP address, browser type, device information, and cookies/local storage used for essential platform functionality.

3. How we use your data

• • Service Delivery — to operate, maintain, and improve the InCoko platform, including agent creation, testing, and deployment.
• • AI Processing — to power voice AI agents using your configuration data, generate call insights, and provide AI chat assistance during agent setup.
• • Communication — to send service-related notifications, respond to access requests, and provide customer support.
• • Security — to detect, prevent, and address fraud, abuse, and technical issues.
• • Legal Compliance — to comply with applicable laws, regulations, and legal processes.

4. Third-party processors

We use the following third-party services to process your data. We do not sell your data to third parties.

5. How we store your data

All data is stored on AWS infrastructure in the us-east-1 region.

• • Encrypted in transit — all data transmitted over TLS 1.2 or higher.
• • Encrypted at rest — AES-256 encryption for stored data via AWS Key Management Service (KMS).
• • Access controls — limited to authorised personnel with role-based access and audit logging.
• • Automated PII/PHI/PCI redaction — call transcripts are automatically scanned and redacted for personally identifiable information, protected health information, and payment card data before storage.

6. Data retention

We retain your data for as long as your account is active or as needed to provide services. You may request deletion of your data at any time by contacting us. Upon account deletion, we will remove your personal data within 30 days, except where retention is required by law.

Call recordings and transcripts are retained according to your workspace settings. We are developing automated data retention policies to give you more control over data lifecycle.

7. Your rights

Depending on your location, you may have the following rights regarding your personal data:

To exercise any of these rights, contact us at privacy@incoko.ai. We will respond within 30 days.

8. State-specific privacy rights

California (CCPA/CPRA)

California residents have the right to: know what personal information is collected and how it is used; request deletion of personal information; opt-out of the sale or sharing of personal information (we do not sell personal information); limit the use of sensitive personal information; and non-discrimination for exercising privacy rights. To submit a verifiable consumer request, contact us at privacy@incoko.ai. We will verify your identity before processing requests. You may also designate an authorized agent to make requests on your behalf.

Virginia (VCDPA)

Virginia residents have the right to: access and obtain a copy of personal data; request deletion of personal data; correct inaccuracies; opt out of processing for targeted advertising, sale, or profiling. You may appeal our decision regarding your request by contacting us at the email above. If your appeal is denied, you may contact the Virginia Attorney General.

Colorado (CPA)

Colorado residents have the right to: opt out of targeted advertising, sale of personal data, and certain profiling; access, correct, and delete personal data; and obtain a portable copy of personal data. You may designate an authorized agent or use a universal opt-out mechanism. Appeals may be directed to the Colorado Attorney General.

Connecticut (CTDPA)

Connecticut residents have the right to: access, correct, and delete personal data; obtain a portable copy; opt out of targeted advertising, sale, and profiling. To exercise these rights, contact us at the email above. Appeals may be directed to the Connecticut Attorney General.

9. Cookies & local storage

We use cookies and browser local storage for the following purposes:

You can manage your cookie preferences through the consent banner displayed on the platform or in Settings > Privacy.

10. Protected Health Information (PHI)

InCoko may process Protected Health Information on behalf of covered entities as defined by the Health Insurance Portability and Accountability Act (HIPAA). In these cases, Biz Digital IT acts as a Business Associate under HIPAA.

Business Associate Agreements (BAAs) are available on request. Contact us at privacy@incoko.ai to initiate a BAA. For more details on our HIPAA compliance posture, see our HIPAA Compliance page.

11. International transfers

Your data is processed and stored in the United States (AWS us-east-1 region). If you are accessing InCoko from outside the United States, your data will be transferred to and processed in the US. By using the platform, you consent to this transfer.

12. Children's privacy

InCoko is not directed at individuals under the age of 13 (or 16 in the EU/EEA). We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will promptly delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the platform after changes constitutes acceptance of the updated policy.