Privacy Policy — Voxoria

Voxoria Ltd ("Voxoria", "we", "us") is committed to protecting your personal data. This policy explains what we collect, why we collect it, and the rights you have under the UK GDPR and the Data Protection Act 2018.

1. Who we are

Voxoria Ltd is a company registered in England and Wales. We are the data controller for the personal data described in this policy. If you have questions, contact us at privacy@voxoria.com.

2. What we collect

We collect the following categories of personal data:

Account data — name, work email, company name, password hash, and role, provided when you create an account.
Billing data — billing address and VAT number. Card details are processed by our payment provider (Stripe) and never stored on our servers.
Usage data — pages visited, prompts you configure, features used, and timestamps. We use this to operate and improve the product.
Technical data — IP address, browser, device type, and log data, collected automatically when you interact with our service.
Marketing preferences — your consent to receive product updates by email.

3. How we use your data

We use your personal data to:

Provide, secure, and improve the Voxoria service;
Process payments and manage subscriptions;
Send transactional emails (receipts, alerts, security notices);
Send product updates and marketing — only where you have opted in;
Comply with our legal and regulatory obligations.

4. Lawful bases

We rely on the following lawful bases under UK GDPR:

Contract — to deliver the service you have signed up for.
Legitimate interests — to operate, secure, and improve our product, and to communicate with customers about their account.
Consent — for marketing emails and non-essential cookies.
Legal obligation — for tax, accounting, and compliance records.

5. Cookies and analytics

We use a small number of essential cookies to keep you signed in and to remember your preferences. We use privacy-respecting analytics to understand how the product is used. You can decline non-essential cookies at any time without losing access to the service.

6. Sharing your data

We do not sell your personal data. We share it only with service providers who help us run the service, under written data processing agreements:

Cloud hosting (AWS, EU regions);
Payments (Stripe);
Transactional email (Resend);
Customer support tooling.

A current list of subprocessors is available on request from privacy@voxoria.com.

7. International transfers

Where data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, with additional safeguards where appropriate.

8. Retention

We keep account data for as long as your account is active, and for a reasonable period after closure to handle disputes, recover debts, and comply with legal obligations. Billing records are retained for six years to meet UK tax law. Backups are rotated and purged on a rolling 35-day cycle.

9. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you;
Have inaccurate data corrected;
Have your data erased ("right to be forgotten");
Restrict or object to processing;
Receive your data in a portable format;
Withdraw consent at any time.

To exercise any of these rights, email privacy@voxoria.com. We will respond within 30 days.

10. Security

We use encryption in transit (TLS 1.2+) and at rest, role-based access controls, audit logging, and regular security reviews. No system is perfectly secure, but we work hard to protect your data.

11. Children

Voxoria is a B2B product and is not intended for children under 16. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email and noted at the top of this page.

13. Complaints

You can lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. We would prefer a chance to address your concerns first — please contact us at privacy@voxoria.com.