Privacy Notice

1. Who we are

VanVox is operated by VANVOX LTD, a company registered in England and Wales under company number 17225704. Our registered office is Suite RA01, 195–197 Wood Street, London, E17 3NU.

VANVOX LTD is the data controller for the account, website, security, support and service-operation information described in this notice — meaning we decide why and how that information is used. For the customer and supplier details a business user enters about other people, a different relationship applies, which we explain in section 2 below. This reflects our current position and remains subject to final legal review.

For anything to do with your privacy or this notice, you can reach us at privacy@vanvox.co.uk. We have not appointed a statutory data protection officer; privacy requests are handled by VANVOX LTD using the contact route above. The Contact page explains the separate support, deletion, security and legal-notice routes.

This notice is effective from 23 July 2026 and was last reviewed on 23 July 2026.

2. Who this notice covers

This notice applies to:

• people who visit our website;
• business users who use VanVox through WhatsApp or the dashboard;
• people who contact us for support;
• customers, suppliers and other contacts whose details a business user enters into, or sends to, the service.

An important point for our business users: when you use VanVox, you may send us information about other people — for example a customer's name and address on a quote, or a supplier's details on a receipt. For that information, you are the data controller and VanVox acts as your processor: we process it only on your instructions, to deliver the service you have asked for, and we do not use it for our own separate purposes. You remain responsible for the information you share about others, including having a proper reason to hold it and giving those people any privacy information they are owed. This describes our current position and is subject to final legal review; the details will be set out in our beta terms and a data processing agreement.

3. Information we process

Depending on how you use VanVox, we may process:

• Account and business-profile information — your business name, contact details, VAT and registration details, and settings.
• WhatsApp identifiers and message metadata — the WhatsApp contact identifier and technical details needed to receive and reply to messages.
• Typed messages — the text you send us over WhatsApp.
• Voice notes and transcripts — audio you send, and the text transcription produced from it.
• Extracted draft details — the structured details we pull out of your message or receipt to build a draft.
• Customer and supplier details — names, addresses and contact details you include for the people you bill or buy from.
• Quotes, invoices and expenses — the records you confirm and keep.
• Receipts and uploaded files — photos of receipts and other files you send.
• Generated PDFs and exports — the documents and export files the service creates for you.
• Support and feedback — messages you send us and any feedback you leave.
• Security, audit and technical information — records we keep to run the service safely and reliably.

It helps to understand that the same underlying information can exist at different stages, and we treat these differently:

• Source message or media — the original text, voice note or receipt image you send.
• Temporary or intermediate data — working data created while we process your request, such as a transcript.
• Structured draft data — a proposed quote, invoice or expense that you have not yet confirmed.
• Confirmed business records — the quotes, invoices and expenses you explicitly confirm and keep.

4. How we obtain information

We receive information:

• directly from you as a business user;
• through WhatsApp, which is operated by Meta, when you message the service;
• from the voice notes, messages and receipts you upload;
• from your account settings and your use of the website;
• from information generated while we process a document, such as a transcript or extracted draft;
• indirectly about your customers or suppliers, through the details you provide about them.

5. Why we use information

We use information to:

• set up and run your account;
• receive and understand your WhatsApp requests;
• transcribe voice notes and extract document details;
• ask clarifying questions when a request is incomplete;
• build draft quotes, invoices and expenses for you to review;
• create the confirmed records you choose to keep;
• generate and send PDFs;
• give you dashboard access and exports;
• keep the service secure and monitor for problems;
• respond to your support and privacy requests;
• keep the operational and audit records we need to run the service responsibly.

For the purposes above where VANVOX LTD is the controller, our current position on the legal bases we rely on under UK data protection law is:

• Contract — to set up and run your account and deliver the core service you sign up for, such as receiving your requests, building drafts and creating the records you confirm.
• Legitimate interests — to keep the service secure, prevent fraud and abuse, maintain its integrity, and send you service-related messages. We only rely on this where our interest does not override your rights.
• Legal obligation — where the law requires us to use or keep certain information, such as responding to a valid rights or legal request.
• Consent — only where it is genuinely needed, such as non-essential cookies. We do not rely on consent as the basis for the core service.

For the customer and supplier information a business user enters about other people, the business user is the controller and chooses the legal basis for that information; VanVox processes it on their instructions (see section 2). The bases above reflect our current position and remain subject to final legal review — they are not a claim that our review is concluded.

6. AI-assisted processing

VanVox uses artificial intelligence to save you time. Specifically:

• voice notes may be transcribed into text using an AI transcription service;
• typed text, transcripts and receipts may be processed by AI to pull out structured details such as amounts, dates and line items.

AI can make mistakes. To keep you in control, VanVox runs its own checks on the extracted details, asks you clarifying questions when something is missing, and shows you a draft to review. VanVox never finalises a quote or invoice without your explicit confirmation. Nothing becomes a confirmed record until you say yes.

This review-and-confirm workflow means the service does not make solely automated decisions that have a legal or similarly significant effect on you. It also does not mean our staff read every draft — the checks are built into the software, and the final decision is always yours. Our AI transparency statement explains where AI is and is not used, and how you stay in control, in more detail.

7. Sharing and service providers

We do not sell your information. We share it only with the service providers we need to run VanVox, and only to the extent required. The categories of provider we rely on are:

• Messaging — Meta, which operates the WhatsApp platform used to send and receive your messages and media.
• AI transcription and extraction — OpenAI, which processes audio and text to produce transcripts and extracted draft details.
• Hosting and storage — the infrastructure and object-storage provider that runs the service and holds files such as receipts and PDFs.
• Email delivery — the provider that sends transactional emails such as password and verification messages.
• Error monitoring — a monitoring provider that helps us detect and fix faults; we scrub personal details from these reports.
• Backups — a backup provider used to keep secure copies of our database for disaster recovery.

Where the exact provider or the region it operates in depends on our deployment, we have used category wording above rather than naming a specific company or place we cannot yet confirm. Our maintained subprocessor register lists the providers we can confirm and is clear about the details we are still verifying.

We may also disclose information where we are legally required to, or to protect our rights and the safety of the service.

8. International processing

Some of the service providers we use may process information outside the United Kingdom. We are verifying exactly where each provider processes information and which transfer safeguards apply. Our subprocessor register sets out the providers we can confirm and the international-processing details we are still verifying. Until that verification is complete, we have chosen not to name a specific country, region or safeguard that we cannot yet confirm from our own records.

9. How long we keep information

We aim to keep information only as long as we need it. In practice:

• voice-note files, transcripts and the text sources used for extraction currently have configurable retention windows, defaulting to 30 days;
• confirmed documents and their associated records remain available as your business records until you delete them or another applicable lifecycle event applies;
• the text of stored WhatsApp messages is redacted after a set period, and the underlying message records are removed after a further period;
• we keep certain technical and audit records for a limited time for security and operational reasons;
• backup copies may persist for a limited time after information is removed from the live service.

Receipt images are covered by automated retention. The application default is 90 days, though the effective period may be set by the deployed configuration. When a receipt image expires, the original image is removed from the live service, but the confirmed expense record you chose to keep is not automatically deleted with it. You can still request deletion through the process described below. Backup copies and copies held by external providers may follow separate retention or deletion cycles.

10. Deletion and account closure

You can ask us to delete your information or close your account. Please read this alongside our data deletion instructions, which explain how to make a request. For a plain-language walkthrough of how your information moves through VanVox from intake to deletion, see our data-lifecycle page.

• you can request deletion directly by contacting us at privacy@vanvox.co.uk;
• we may need to verify your identity before acting on a request;
• we aim to action verified deletion requests within 30 days;
• some information may remain temporarily in backups after it is removed from the live service;
• we may need to keep some information where the law or a legitimate operational reason requires it.

Deleting a customer or a document removes it from the live service, but it may not be the same as immediate removal from every backup copy. We are honest about this rather than promising complete erasure everywhere at once.

11. How we protect information

We take practical steps to protect information, including:

• access controls and server-side checks so that a business only sees its own data;
• a privacy-conscious logging design that keeps message content and transcripts out of our application logs by default;
• security monitoring to help us detect and respond to problems;
• encryption of information in transit over the connections used by the website and provider APIs;
• encryption of particularly sensitive stored fields, such as bank details.

No service can promise perfect security, and we do not claim to. We keep the specific details of our defences private so that publishing them does not make the service easier to attack. Our security statement explains these controls, and their honest limits, in more detail.

12. Your rights

Under UK data protection law you have rights over your personal information. Depending on the circumstances, these include the right to:

• ask for access to the information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete information;
• ask us to restrict how we use information;
• object to certain uses of information;
• ask for a copy of certain information in a portable format, where that right applies;
• withdraw your consent, where we rely on consent for a particular use;
• complain to the Information Commissioner's Office (ICO).

Some of these rights do not apply in every situation. If we cannot act on a request, we will explain why. To exercise a right, contact us at privacy@vanvox.co.uk.

If you are unhappy with how we handle your information, you can complain to the ICO at https://ico.org.uk/make-a-complaint/. We would appreciate the chance to put things right first, so please consider contacting us before you do.

13. Children

VanVox is a business service intended for use by adults running a business. It is not designed for or directed at children, and we do not knowingly collect information from children.

14. Changes to this notice

We may update this notice from time to time. When we make a material change, we will update the effective date at the top of this page and, where appropriate, let you know through the service. We encourage you to review this page occasionally.

15. How to contact us

VanVox is operated by VANVOX LTD (company number 17225704), registered in England and Wales, registered office Suite RA01, 195–197 Wood Street, London, E17 3NU.

For any privacy question or request, email privacy@vanvox.co.uk. For support, deletion, security reports and formal legal notices, see the Contact page. You can also confirm our company details on the Companies House register.