Verifas VoiceLab · effective 2026-09-26
Verifas VoiceLab is a SIP and voice testing platform operated by Verifas Networks, Amsterdam, the Netherlands (KvK 42182088) ("we", "us"). For privacy questions or to exercise your rights, contact privacy@verifasnetworks.com.
We act in two different capacities, and this policy is clear about which applies: • Controller — for data about the people who visit our website, contact us, or hold a user account (name, email, sign-in and billing data). This policy governs that data. • Processor — for the test data our customers put through the Platform (SIP credentials, dialled numbers, call records, signalling, packet captures and call audio). We process it only on the customer’s instructions to run the tests they configure. The customer is the controller of that data and is responsible for having a lawful basis to test with it. A Data Processing Agreement (DPA) is available to every customer on request.
Website visitors and enquiries: • Contact-form submissions — your name, email, company, message, and the IP address the form was sent from (included so we can deal with abuse). The form is delivered as email to our own mail server; it is not stored in a marketing database. • We do not use analytics, advertising or tracking scripts on this website, and it loads no third-party fonts or scripts.
Account holders: • Account data — email, name, organisation and team membership, role, plan, and your password (stored only as a one-way hash). If you enable two-factor authentication, its secret. • Security data — sign-in events, the IP addresses used, and an audit log of administrative actions. • Billing data — if you take a paid plan, the billing contact, company name, address and VAT number we need to invoice you, and the invoices themselves. We do not take card payments online.
Customer test data (processed on the customer’s behalf): • SIP account credentials and number inventories you configure for testing. • Call records — calling and called numbers, timestamps, durations, codecs, response codes and quality metrics. • SIP signalling — full SIP messages exchanged during tests, including their headers. • Packet captures and call audio — PCAP/RTP captures of test calls, recordings made for voice-quality scoring, and audio files you upload as announcements or reference samples. • Message bodies — the text of SIP MESSAGE (SMS) tests you send. • Browser-phone audio — if you use the in-browser phone, your microphone audio is carried into the test call, and is captured like any other call media for that call.
We use account data to provide and secure the Service, authenticate you, bill you, give support, detect abuse and fraud, and meet legal obligations. We use customer test data only to run and report the tests you configure; we do not inspect captures or recordings except to deliver the analysis you request, or — with your permission — to resolve a support case. We do not sell personal data, use it for advertising, or use customer test data to train any model.
We process personal data under GDPR Article 6: performance of our contract with you (Art. 6(1)(b)), our legitimate interests in operating and securing the service (Art. 6(1)(f)), compliance with legal obligations (Art. 6(1)(c)), and your consent where required (Art. 6(1)(a)).
The Platform places real calls on live networks and can capture their signalling and media. You may test only numbers and endpoints you own or are authorised to test, and must not capture or upload calls or signalling belonging to people who have not agreed to it. Where a test reaches an endpoint operated by someone else, obtaining any consent required for capture is your responsibility. The full rules are in our Terms of Service, Sections 4 and 5.
The Platform and its data are hosted in the European Union. Customers who run their own test nodes can keep captures and recordings on those nodes, so that call content never leaves the machine that recorded it; in that case it is stored wherever the customer runs the node.
Where data leaves the EEA, we rely on European Commission adequacy decisions or Standard Contractual Clauses (SCCs) with appropriate safeguards.
Test data is deleted automatically on these default schedules, which can be adjusted by agreement with a customer: • Packet captures — 7 days from the call. • Call records — 90 days on the free plan, 365 days on the enterprise plan. • SLA test history — 30 days on the free plan, 365 days on the enterprise plan. • Captures held on test nodes are kept in a rolling buffer and overwritten as it fills. If you need specific records or captures deleted sooner, contact us and we will delete them.
Account data is kept while your account is open. When you close your account, sign-in is disabled at once, and we erase the account and its test data within one month of your request, except for records we must keep by law (invoices and bookkeeping records are kept for 7 years under Dutch tax law) or that we need to establish or defend legal claims. Contact-form emails are kept only as long as the enquiry and any resulting business relationship need them.
Traffic to the Platform is encrypted in transit with TLS. Passwords are stored as one-way hashes; credential files uploaded for load tests and alerting secrets are encrypted at rest. Each customer’s data is isolated from every other customer’s, access is role-based and can require two-factor authentication, and administrative actions are audit-logged. No system is perfectly secure: if a breach affects your personal data, we will notify the regulator and you as the law requires — for customers acting as controllers, without undue delay after we become aware of it.
Under General Data Protection Regulation (EU) 2016/679 (GDPR) and the Dutch GDPR Implementation Act (UAVG), you may: • access your personal data and obtain a copy; • rectify inaccurate or incomplete data; • erase your data ("right to be forgotten"); • restrict or object to processing; • data portability (receive your data in a machine-readable format); • withdraw consent at any time, without affecting prior processing; • lodge a complaint with a supervisory authority. To exercise any right, email privacy@verifasnetworks.com. We answer within one month, and may need to confirm your identity first. If your data is in the Platform as customer test data, we will pass your request to the customer who controls it and help them respond. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl), or your local EU supervisory authority.
The Service is for business and professional use and is not directed at children. We do not knowingly collect data from children.
When we change this policy we will publish the new version here with a new effective date, and tell account holders by email about material changes. This version is effective 2026-09-26.
Verifas Networks, Amsterdam, the Netherlands, KvK 42182088. Email: privacy@verifasnetworks.com.