1. Introduction
Abbax, Inc. ("Abbax," "we," "us," or "our") operates a unified communications and product workspace platform — including Hosted VoIP, Cloud Fax, Threads, Roadmap, Insights, and Abbax AI (collectively, the "Services"). This Privacy Policy explains what information we collect about you, how we use it, who we share it with, and the choices you have.
This policy applies to information we collect through our websites, applications, APIs, and customer support channels. By using the Services, you agree to the practices described here.
2. Information we collect
2.1 Information you provide
- Account data — name, work email, company, role, password, and billing details.
- Workspace content — threads, messages, documents, roadmap items, integrations data, and other content you create or upload.
- Communications data — call audio, call metadata (numbers, duration, time), fax documents, transcriptions, and AI-generated summaries.
- Support & sales communications — anything you send us via email, chat, calls, or forms.
2.2 Information collected automatically
- Usage data — pages viewed, features used, click events, timestamps, and referrer URLs.
- Device & network data — IP address, browser type, operating system, device identifiers, and approximate location (city/region).
- Cookies & similar technologies — see Section 8.
2.3 Information from third parties
- Integrations — when you connect Slack, GitHub, Salesforce, HubSpot, Epic, or other tools, we receive data those services share with you.
- SSO providers — when you log in via Google, Microsoft, or Okta, we receive your basic profile.
- Public sources — limited business information for verification or fraud prevention.
3. How we use information
We use information to:
- Provide, maintain, and improve the Services.
- Process calls, faxes, messages, and AI requests on your behalf.
- Authenticate users, secure accounts, and prevent fraud or abuse.
- Process payments and manage subscriptions.
- Provide customer support and respond to requests.
- Send service notices, security alerts, and product updates.
- Send marketing communications (which you can opt out of at any time).
- Analyze usage to improve features, performance, and user experience.
- Comply with legal obligations and enforce our terms.
Abbax AI: Customer content processed by Abbax AI is not used to train our base or third-party foundation models. Your workspace data is isolated to your tenant.
5. Data retention
We retain information for as long as your account is active or as needed to provide the Services. Specific retention periods include:
- Workspace content — retained until you delete it or close your account.
- Call recordings & transcripts — retained per your workspace settings (default 90 days, configurable).
- Fax audit logs — retained 7 years for HIPAA and SOC 2 compliance.
- Billing records — retained 7 years for tax and accounting requirements.
- Backups — purged within 35 days of deletion from primary systems.
After account closure, we delete or anonymize remaining data within 90 days unless legally required to retain it longer.
6. Security
We implement administrative, technical, and physical safeguards designed to protect your information:
- SOC 2 Type II audited annually.
- AES-256 encryption at rest, TLS 1.3 in transit, SRTP for voice media.
- FIPS 140-2 validated cryptographic modules.
- Role-based access controls, SSO, and MFA available on every plan.
- HIPAA-compliant infrastructure with BAA available for healthcare customers.
- Annual penetration testing by independent third parties.
- 24/7 security monitoring and incident response.
No system is 100% secure. If we learn of a security incident affecting your information, we will notify you and regulators as required by law.
7. Your rights
Depending on your jurisdiction, you may have the right to:
- Access a copy of personal information we hold about you.
- Correct inaccurate or incomplete information.
- Delete personal information (subject to legal exceptions).
- Export your data in a portable format.
- Object to or restrict certain processing activities.
- Withdraw consent at any time (where processing is based on consent).
- Lodge a complaint with your local data protection authority.
To exercise these rights, email privacy@abbax.com. We will respond within 30 days.
California residents: Under the CCPA/CPRA, you also have the right to know what categories of personal information we collect and to opt out of "sharing" for cross-context behavioral advertising. We do not sell personal information.
9. International transfers
Abbax is headquartered in the United States with infrastructure in the US, EU, and Australia. When we transfer personal information across borders, we rely on:
- EU Standard Contractual Clauses (SCCs) for EEA/UK transfers.
- Data Processing Addenda with all sub-processors.
- Regional data residency options on Enterprise plans (US-only or EU-only).
10. Children's privacy
The Services are designed for business use and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be announced via in-app notice or email at least 30 days before they take effect. Continued use of the Services after the effective date constitutes acceptance.
12. Contact us
For privacy questions, data requests, or to contact our Data Protection Officer: