Privacy Policy

Voxoria Ltd ("Voxoria", "we", "us") is committed to protecting your personal data. This policy explains what we collect, why we collect it, and the rights you have under the UK GDPR and the Data Protection Act 2018.

1. Who we are

Voxoria Ltd is a company registered in England and Wales. We are the data controller for the personal data described in this policy. If you have questions, contact us at privacy@voxoria.com.

Where data retrieved through the service at your request contains personal data, we process it on your behalf and on your instructions. You decide what is requested and are responsible for having a lawful basis for it.

2. What we collect

We collect the following categories of personal data:

• Account data: name, work email, company name, password hash, and role, provided when you create an account.
• Billing data: billing address, VAT number, and a record of the funds you add and the charges made to your balance. Card details are processed by our payment provider (Stripe) and never stored on our servers.
• Requests and results: the requests you or your agents make through the service, and the data returned, which we store so you can retrieve it later. This is mostly data about websites and businesses, but it can include personal data where a source returns it, such as names in public reviews or published work contact details.
• Provider credentials: API keys you connect for third-party data providers.
• Usage data: pages visited, features used, and timestamps. We use this to operate and improve the product.
• Technical data: IP address, browser, device type, and log data, collected automatically when you interact with our service.
• Marketing preferences: your consent to receive product updates by email.

3. How we use your data

We use your personal data to:

• Provide, secure, and improve the Voxoria service;
• Send your requests to third-party data providers and store the results for you;
• Process payments, maintain your account balance, and manage any subscription;
• Show you what your account has spent;
• Send transactional emails (receipts, alerts, security notices);
• Send product updates and marketing, only where you have opted in;
• Comply with our legal and regulatory obligations.

4. Lawful bases

We rely on the following lawful bases under UK GDPR:

• Contract: to deliver the service you have signed up for.
• Legitimate interests: to operate, secure, and improve our product, and to communicate with customers about their account.
• Consent: for marketing emails and non-essential cookies.
• Legal obligation: for tax, accounting, and compliance records.

5. Cookies and analytics

We use a small number of essential cookies to keep you signed in and to remember your preferences. These are always active, because the service cannot function without them.

We also use Google Analytics to understand how our website and product are used. Analytics cookies are non-essential. When you first visit our site, a banner lets you accept or decline them. We use Google Consent Mode, so no analytics cookies are stored, and no data is shared with Google, until you accept. If you decline, analytics stays off and no analytics cookies are set. You can change your choice at any time by clearing this site's cookies and site data in your browser, which brings the banner back.

6. Sharing your data

We do not sell your personal data. We share it only with service providers who help us run the service, under written data processing agreements:

• Cloud hosting (DigitalOcean);
• Payments (Stripe);
• Transactional email (Resend);
• Error and performance monitoring (Sentry, Datadog);
• Website and product analytics (Google LLC);
• Customer support tooling.

To answer a request, we send its content (for example a keyword, a domain or a company name) to the third-party data provider that supplies the data. The providers are listed in our catalog. Where you connect your own credentials for a provider, the request is made under your agreement with that provider.

A current list of subprocessors is available on request from privacy@voxoria.com.

7. International transfers

Where data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, with additional safeguards where appropriate.

8. Retention

We keep account data for as long as your account is active, and for a reasonable period after closure to handle disputes, recover debts, and comply with legal obligations. Stored requests and results, and any provider credentials you connect, are kept while your account is active and deleted within 60 days of closure. Billing records are retained for six years to meet UK tax law. Backups are rotated and purged on a rolling 35-day cycle.

9. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you;
• Have inaccurate data corrected;
• Have your data erased ("right to be forgotten");
• Restrict or object to processing;
• Receive your data in a portable format;
• Withdraw consent at any time.

To exercise any of these rights, emailprivacy@voxoria.com. We will respond within 30 days.

10. Security

We use encryption in transit (TLS 1.2+) and at rest, role-based access controls, audit logging, and regular security reviews. No system is perfectly secure, but we work hard to protect your data.

11. Children

Voxoria is a B2B product and is not intended for children under 16. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email and noted at the top of this page.

13. Complaints

You can lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. We would prefer a chance to address your concerns first; please contact us atprivacy@voxoria.com.