How your information moves through VanVox

The lifecycle, step by step

Each numbered step below describes one stage. The steps run in order, and each one is labelled with its number and name so the sequence is clear without relying on colour.

1. 1

   Step 1: You send information

   You start with a WhatsApp text, a voice note, a receipt photo, or an entry you type in the dashboard. Nothing happens until you choose to send something.

2. 2

   Step 2: VanVox receives it

   The message content and the provider metadata that comes with it are received. Duplicate inbound messages are safely ignored, so sending the same thing twice does not create two records.

3. 3

   Step 3: Temporary processing

   Voice notes may be downloaded and transcribed. Typed text or a receipt image may be analysed to read the details. Any intermediate working data is created only to carry out the request you made, and is not a record of its own.

4. 4

   Step 4: Structured draft creation

   The details are extracted into a draft. Validation checks amounts, dates, the parties involved and the line items. If something is missing or unclear, VanVox asks you a clarifying question rather than guessing.

5. 5

   Step 5: Review and correction

   You see a summary of the draft and can correct it. Deterministic edits are preferred, so a clear instruction is applied directly; AI assistance is used only where it is genuinely needed to interpret what you meant.

6. 6

   Step 6: Explicit confirmation

   A quote or invoice is not finalised until you explicitly confirm it. An expense follows its own confirmation step, but it too requires your explicit yes before it becomes a kept record. AI-assisted output stays a draft until you confirm — it does not become a record automatically.

7. 7

   Step 7: Confirmed record

   Once you confirm, the quote, invoice or expense becomes a structured business record that belongs to your business. Confirmed records can remain after the source artefacts that produced them have expired.

8. 8

   Step 8: PDF and delivery

   A PDF may be generated and returned to you through WhatsApp, or downloaded from the dashboard. Outbound sends are deduplicated, so a retry does not send you the same document twice.

9. 9

   Step 9: Retention

   Different kinds of information follow different rules. Source artefacts, transcripts, receipt images, failed-processing records and confirmed records are not all kept for the same period. Receipt images are covered by automated retention, with an application default of 90 days; the effective period is deployment-configurable and set by configuration.

10. 10

    Step 10: Deletion and redaction

    You can ask us to delete your information. Live records may be deleted or redacted, and customer and document snapshots may be redacted rather than kept in full. Hosted links are revoked where supported. Deletion may still preserve limited records where the law or a necessary operational reason requires it.

11. 11

    Step 11: Backups and providers

    Backups and copies held by external providers may expire on separate cycles. Removing something from the live service is not the same as immediate erasure everywhere, and we say so rather than promise complete removal from every system at once.

The states your information can be in

The same underlying information can exist in different states at once, and VanVox treats each state differently. This is why not everything is kept for the same length of time.

Voice, typed text and receipt images

How your information is handled depends on how you send it. Voice and typed text are equally valid ways to create a draft, but the steps behind them differ.

If something fails or is retried

• heavy processing happens in the background rather than while you wait;
• safe retry is designed to prevent duplicate confirmed records or duplicate outbound sends if a step runs more than once;
• failed-processing records are kept for a bounded period so a problem can be investigated, then removed;
• ordinary logs are designed to avoid message bodies and transcripts, using safe identifiers, statuses and timestamps instead.

Asking us to delete your information

• you can request account and data deletion through our data deletion route;
• we may need to verify your identity before acting on a request;
• live records are deleted or redacted according to the rules that apply to them;
• hosted links are revoked where supported;
• backups and provider copies follow separate cycles, so removal is not immediate everywhere;
• we may keep limited information where the law or a necessary operational reason requires it.

See the data deletion instructions for how to start, and the Privacy Notice for the full detail.

Providers and where processing happens

VanVox relies on a small set of service providers to run the product, and some processing may take place outside the United Kingdom. Not all provider copies are under VanVox’s direct control. Exactly where each provider processes information, and which transfer safeguards apply, remains subject to human and legal verification. The maintained list lives in our subprocessor register rather than being duplicated here.