Privacy Policy

1. Data controller

Voice PA Limited (“Voice PA”, “we”, “us”, “our”) is the data controller responsible for your personal data.

• Company number: 17057403 (registered in England and Wales)
• Registered address: 14 Sollershott West, Letchworth Garden City, Hertfordshire, SG6 3PX
• Privacy contact: privacy@voicepa.ai
• Website: voicepa.ai

We operate an AI-powered phone receptionist service for tradespeople and small service businesses in the United Kingdom.

Who controls your data. For most of the data we handle — your provider account, our website analytics, and the prospect research we carry out — Voice PA is the sole data controller (we decide why and how it is processed). For the calls our AI receptionist answers on a tradesperson's behalf — including caller details, bookings and call recordings — Voice PA and the tradesperson are joint controllers: the tradesperson runs the customer relationship and acts on the booking, while Voice PA decides how the AI works, what is recorded, how long data is kept, and how it is kept secure. You can raise a data-protection request with either of us, and you can always reach Voice PA at privacy@voicepa.ai.

2. What data we collect

We collect and process the following categories of personal data:

• Account information — your name and email address, either from Google, Microsoft or Apple sign-in or entered by you if you sign up with an email address and password. Passwords are held by our authentication provider, Clerk, not by us.
• Business information — business name, trade category, services offered, pricing, working hours, service area, and contact details you provide during onboarding.
• Call data — phone numbers, call recordings, call transcripts, AI-generated summaries, service requests, and booking details from calls handled by our AI receptionist.
• Booking data — customer names, phone numbers, email addresses, postal addresses, postcodes, and appointment details collected during the booking process.
• Calendar data — where you connect a calendar (Google, Microsoft or Apple), and only with your permission, we read the busy times of your existing events to work out which appointment slots you are free for, and we create, update, or delete booking events when an appointment is made, changed, or cancelled. See section 8 for how we handle Google Calendar data specifically.
• Payment data — processed securely by Stripe. We store your Stripe customer ID and subscription status but do not store card numbers or bank details on our servers.
• Website usage data — information about how you interact with our website and dashboard, collected through PostHog analytics where you have given consent. If you are signed in, this is linked to your account. We also record key account events on our servers, such as starting a trial or subscribing (see sections 3 and 6).
• Cookie data — essential cookies required for the service to function, and a campaign-attribution cookie (with your consent). See section 6 for full details.
• Support and contact data — messages you send us through the in-app support chat, the “report a problem” form, the contact form, the waitlist, or by email.
• Test calls — if you try your AI assistant from your browser, the audio from your microphone is processed by Telnyx for that call.
• Device notifications — if you allow browser notifications, a subscription token for your browser so that we can send them.
• Security logs — IP address, browser type and the actions taken on an account, used to protect accounts and detect misuse.
• Prospective customers — business contact details collected from public directories, as described in section 15.
• Consent records — records of the consents you or your customers have given or withdrawn, including the type of consent, method, and timestamp.

You must give us your name, email address and business details to use the service; without them we cannot set up your receptionist. Callers do not have to give their details, but without them we cannot book an appointment for them.

3. Lawful basis for processing

Under UK GDPR Article 6, we must have a lawful basis for each processing activity. The table below sets out the lawful basis we rely on for each type of processing:

4. Call recording

Our AI receptionist is powered by Telnyx. At the start of each call, callers are informed that they are speaking with an AI assistant and that the call is recorded. We rely on our legitimate interests as the lawful basis for recording (see section 3); the call-start disclosure means callers are on notice and can end the call if they do not wish to be recorded.

We store the following call data:

• Call transcript — a text transcription of the conversation.
• Call summary — an AI-generated summary of the call including any service requests and booking details.
• Recording URL — a link to the audio recording, hosted by Telnyx.
• Caller phone number — the number the caller dialled from.
• Call metadata — duration, timestamp, and call disposition.

If a caller has called or booked with the same business before, the AI receptionist is given their name and the date and notes of their last booking, so that it can greet them properly.

Call recordings and transcripts are retained for 12 months from the date of the call (see section 10 for full retention periods). You or the caller may request deletion of call data at any time by contacting privacy@voicepa.ai.

5. SMS and WhatsApp messaging

We send the following types of messages via SMS (using Telnyx):

• Transactional messages — booking confirmations and appointment reminders to callers, and call and booking alerts to tradespeople. These are sent as part of the service that has been requested and do not require separate marketing consent under PECR.
• Marketing messages — promotional messages sent only with your explicit consent. These comply with PECR Regulation 22.

How to opt out: You can opt out of marketing messages at any time by replying STOP to any message, or by using the consent management page linked in your messages. Opting out of marketing will not affect transactional messages necessary for delivering the service.

All marketing SMS messages include opt-out instructions in compliance with PECR.

WhatsApp: if you are a tradesperson and switch on WhatsApp in your settings, we send your call summaries, new-booking alerts and account messages to you on WhatsApp instead of SMS. These messages include your caller's name, phone number and what they called about. They are carried by Telnyx and delivered through WhatsApp, which is operated by Meta. Replies you send us on WhatsApp are received the same way. You can switch WhatsApp off in your settings at any time, and we will go back to SMS.

6. Cookies and analytics

We use the following types of cookies and similar technologies:

• Essential cookies — required for the website and service to function. They are exempt from consent under paragraph 4 of Schedule A1 to the Privacy and Electronic Communications Regulations 2003 because they are strictly necessary. They are: cc_cookie (remembers your cookie choices, for 12 months); NEXT_LOCALE (remembers your language, until you close your browser); our authentication provider Clerk's sign-in cookies, such as __session and __client_uat (keep you signed in); and, on the payment page only, Stripe's fraud-prevention cookies, such as __stripe_mid and __stripe_sid.
• Analytics — PostHog helps us understand how visitors use our website and dashboard. It runs only after you consent, which you can manage via our cookie consent banner, and it does not store cookies on your device.
• Campaign attribution — if you arrive from a link we share (an advert, a partner, an email), we record which campaign it was. It is stored on your device as a cookie named voicepa_utm and in your browser’s session storage. This is part of our analytics category, so it is only stored with your consent and is erased if you withdraw it.

What PostHog collects: page views, button clicks, session duration, device type, browser type, and approximate location worked out from your IP address (at most town or city level). PostHog does not collect precise geolocation. If you are signed in and have accepted analytics, we link this information to your account, including your name and email address. We use this data to improve the service and understand usage patterns.

Account events recorded on our servers: separately from the consent-based analytics above, our servers send PostHog a small number of account events — such as starting a trial, subscribing, cancelling, a failed payment, or a booking being confirmed — linked to your account. These do not use cookies or anything stored on your device, and we rely on our legitimate interests for them (section 3).

Performance monitoring: to keep the site fast and working, we measure page-load speed and record errors using Vercel Speed Insights and Sentry. These run for every visitor, do not use cookies, and are not used to identify you.

What campaign attribution collects: the campaign source, medium, name and content from the link you followed, plus the trade and the type of link you came from (an email, an advert, a referral). The cookie itself doesn’t contain your name or email address, and it lasts 60 minutes. If you create an account in that time, we save these values to your account record so we can tell which campaigns bring people to Voice PA. They are then held for as long as that record is (section 10).

You can change your cookie preferences at any time: Manage cookie preferences.

7. Data sharing and sub-processors

We share personal data only with the following third-party service providers (sub-processors), solely to operate the service. We do not sell your personal data to any third party.

8. Google user data and Limited Use

The use of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This section explains what that means in practice.

What we ask for. When you choose to connect your Google Calendar, we request a single Google Calendar permission and nothing else. We do not request access to Gmail, Google Contacts, or Google Drive.

What we do with it. We use your Google Calendar for exactly two things, both on your behalf and both necessary to run your AI assistant:

• Reading busy times — we read when your existing events are busy so we can work out which appointment slots you are genuinely free for, and so the AI receptionist does not offer a caller a time you have already blocked out.
• Writing booking events — we create a booking event when the AI receptionist takes an appointment, and update or delete it if that appointment changes or is cancelled.

Raw calendar content never leaves our servers. The titles, descriptions, locations, and attendees of your existing events are not sent to the AI that speaks to your callers. The only calendar-derived information that AI ever receives is availability worked out on our own servers — a date, a start time, and an end time for the slots you are free for — so that it can offer a caller a time. It has no way to request or read the content of your calendar.

We do not use Google data to train AI models. We do not retain or use information received from Google Workspace APIs to develop, improve, or train generalised or non-personalised artificial-intelligence or machine-learning models. Your Google data is used only to provide the calendar features described above, at your direction.

Your Google Calendar data is not sent to our third-party AI provider. We use the Vercel AI Gateway (United States), which routes to a Google Gemini model, for features that sit outside the call path entirely: the in-app support chat, an automated check on the service names you enter, internal drafting of our own marketing content, and sorting public trade-forum posts by relevance. None of them touches your calendar: no Google Calendar data — neither raw event content nor the availability we derive from it — is sent to that gateway or to the model behind it. Those features run on information you have entered yourself and on our own content.

We do not share your Google data with third parties for advertising or any other unrelated purpose, and we do not sell it. You can disconnect your calendar at any time from your dashboard settings, and you can ask us to delete the data we hold by contacting privacy@voicepa.ai (see section 11).

9. International data transfers

Our voice AI runtime is EU-resident: Telnyx and the AI-pipeline providers it orchestrates (Deepgram for transcription and Anthropic for the language model) process call data in the European Union, and text-to-speech is handled natively by Telnyx. Neon, AWS, Vercel and Ideal Postcodes process data in the United Kingdom; Upstash processes data in the United Kingdom (London); and PostHog and Sentry process data in the European Union. Some of our other sub-processors process data in the United States — including Stripe, Clerk, Resend, Apify, Atlassian, Cloudflare, the Vercel AI Gateway (and the Google Gemini model behind it), and Apple (with Google, Microsoft and Meta in the United States or EEA). The Vercel AI Gateway is not part of the AI receptionist: it supports only the features described in section 7, and it receives no call recordings, no call transcripts, and no calendar data (see section 8). Where personal data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place:

• UK-EU adequacy — the United Kingdom and the European Union each recognise the other as providing an adequate level of data protection, and the EU renewed its adequacy decision for the UK in December 2025 (running to December 2031). Our EU-resident processing (Telnyx in Germany, and PostHog and Sentry in the EU) is therefore covered by adequacy and needs no further transfer safeguard.
• UK-US Data Bridge — for our US-based providers that are certified under the UK Extension to the EU-US Data Privacy Framework (for example Stripe, Clerk, Resend, Google and Microsoft), transfers are covered by the UK-US Data Bridge.
• Standard Contractual Clauses and transfer risk assessments — for any transfer outside the UK that is not covered by adequacy or the Data Bridge (for example Apify and Apple), we use the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the ICO's UK Addendum. Before relying on them we assess, as UK law requires, that the protection your data receives will not be materially lower than in the United Kingdom (the “data protection test”), and we record that in a transfer risk assessment. We treat these clauses as our primary safeguard even where a provider is also Data Bridge-certified.

You can request a copy of the safeguards we use by contacting privacy@voicepa.ai.

10. Data retention

We retain your personal data only for as long as necessary for the purposes set out in this policy. The specific retention periods are:

After the applicable retention period, data is securely deleted or anonymised. You can request early deletion of your data at any time (see section 11).

11. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access (Article 15) — you have the right to request a copy of the personal data we hold about you. You can do this via the consent management page or by emailing privacy@voicepa.ai.
• Right to rectification (Article 16) — you have the right to ask us to correct any inaccurate personal data we hold about you. Contact us at privacy@voicepa.ai.
• Right to erasure (Article 17) — you have the right to request deletion of your personal data. We will comply unless we have a legal obligation to retain it. You can request this via the consent management page or by emailing us.
• Right to restriction of processing (Article 18) — you have the right to ask us to restrict how we process your data in certain circumstances, for example while we verify the accuracy of your data.
• Right to data portability (Article 20) — you have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON), and to have it transferred to another controller where technically feasible.
• Right to object (Article 21) — you have the right to object to processing based on legitimate interests (such as fraud prevention). We will stop processing unless we can demonstrate compelling legitimate grounds.
• Your absolute right to object to direct marketing (Article 21(2)) — you can object at any time, free of charge, to our using your personal data for marketing. If you do, we will stop. We do not need to give reasons and neither do you.
• Right to withdraw consent (Article 7(3)) — where we process your data based on consent (such as marketing SMS or analytics cookies), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Automated decision-making: We do not make decisions about you based solely on automated processing that produce legal effects for you or that similarly significantly affect you. Our AI receptionist takes your enquiry and books an appointment, but a real tradesperson decides whether and how to carry out the work. If this ever changes, we will tell you and explain your rights to a human review of the decision.

How to exercise your rights: You can exercise these rights via the consent management page (linked in your SMS messages), or by contacting us at privacy@voicepa.ai. We will respond within one month. We only ask you to give us what is reasonable and proportionate to help us find your data. If we need to confirm who you are, or ask you to narrow down a broad request, the one-month clock pauses until you reply (a “stop-the-clock” pause under the Data (Use and Access) Act 2025). Where a request is especially complex, or you have made a number of requests, we may extend the response time by up to a further two months and will tell you why within the first month.

12. Complaints and the regulator (ICO)

Complaining to us: If you are unhappy with how we have handled your personal data, you can make a complaint to us at any time by email to privacy@voicepa.ai, or by post to Voice PA Limited, 14 Sollershott West, Letchworth Garden City, Hertfordshire, SG6 3PX. You do not need to use any particular form — just tell us what has gone wrong. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated on our progress, and tell you the outcome. We would appreciate the chance to put things right first.

Complaining to the regulator: You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO). From 30 September 2026 the regulator is the Information Commission, which continues to be known as the ICO:

• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Website: ico.org.uk
• Telephone: 0303 123 1113

Complaining to us first does not affect your right to go to the ICO at any time.

13. Children

Voice PA is a business-to-business service designed for tradespeople and service businesses, and accounts are only for adults running a business: all users must be at least 18 years old. People who call a business that uses Voice PA may occasionally be under 18; we handle their call data in the same way as any other caller's, and a parent or guardian can contact privacy@voicepa.ai about it.

14. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email or through a prominent notice on our website. The “Last updated” date at the top of this page indicates when the policy was last revised.

We encourage you to review this policy periodically.

15. If we have contacted you about Voice PA (prospective customers)

If you run a trade or service business, we may collect your business details from public business directories and listings, such as Checkatrade, Bark, Google Maps and the Gas Safe Register, so that we can decide whether Voice PA may help your business and tell you about it. Apify (United States) runs this collection for us.

We may collect your name (where it is published), business and trading names, trade, business phone number, business email address, website and directory profile links, service area, town and postcode, and your public rating. We rely on our legitimate interests in telling businesses about a service that may help them (UK GDPR Article 6(1)(f)); our assessment is available on request. We keep these details for up to 12 months from when we collected them, or until you object, whichever is sooner. If you object, we keep only what we need to make sure we do not contact you again.

We only send unsolicited marketing emails to limited companies and other incorporated bodies. We do not send unsolicited marketing emails or texts to sole traders or partnerships. We may phone your business about Voice PA, but we never call numbers registered with the Telephone Preference Service or the Corporate Telephone Preference Service, and we will stop if you ask. If we email you, we may record whether the email was opened and whether a link in it was clicked.

You can object at any time, and we will stop using your details for marketing straight away. Email privacy@voicepa.ai, or use the unsubscribe link in any email we send you.

16. Contact

If you have any questions about this privacy policy or how we handle your personal data, please contact us:

• Email: privacy@voicepa.ai
• Data controller: Voice PA Limited, 14 Sollershott West, Letchworth Garden City, Hertfordshire, SG6 3PX, company number 17057403