New Voco now answers WhatsApp, sorts your email and follows up for you.
New Voco now answers WhatsApp, sorts your email and follows up for you. See what's new

Legal

Privacy Policy

This Privacy Policy explains how Voco Digitals Ltd, trading as Voco, collects, uses, shares and protects personal data when you use the Voco AI receptionist, and the rights you have over it under UK GDPR.

Last updated October 2026 ยท Voco Digitals Ltd, company number 16967764

1. Introduction

Voco Digitals Ltd, trading as Voco ("we", "our", "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI receptionist service.

We are registered with the Information Commissioner's Office (ICO) and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

We collect information that you provide directly to us, including:

  • Contact information (name, email address, phone number)
  • Business information (business name, type, location)
  • Call recordings and transcripts when using our AI receptionist service
  • Messages handled by Voco, including web chat, email and WhatsApp messages, with any photos and voice notes they contain and transcripts of those voice notes
  • Where a business links its WhatsApp Business account to Voco, the details described in section 7
  • Payment and billing information
  • Communications with our support team

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our services
  • Process transactions and send related information
  • Send promotional communications (with your consent)
  • Respond to your comments and questions
  • Comply with legal obligations

5. Data Sharing

We do not sell your personal data. We may share information with:

  • Service providers who assist in our operations, under data processing agreements. Section 9 names the providers that handle WhatsApp and Meta data
  • Business systems you have connected to Voco yourself, such as your storage management software, your CRM or your calendar, and only the data needed for the features you have turned on
  • Meta (WhatsApp), which carries every WhatsApp message sent or received through Voco
  • Professional advisers (lawyers, accountants)
  • Regulatory authorities when required by law

6. Connected Business Systems

Voco can connect to software you already use, so that a call can finish the job rather than just report it. Connecting is always something you do yourself, from your dashboard, and you approve exactly what Voco may see and do at the point you connect.

Once connected, we send that system only what it needs to complete what the caller asked for. For a storage booking taken on a call, that is the caller's name, email address, phone number and the details of the unit they booked. We read back from that system the information the AI needs to answer honestly on the call, such as what is available, what it costs and whether a booking has been paid for.

We never receive or store card details. Where a caller pays for something during a call, we send them a link to the provider's own secure payment page and the payment is taken by that provider. Card numbers are never spoken to the AI, never pass through Voco and are never held by us.

You can disconnect at any time from your dashboard, which withdraws Voco's access to that system. The provider you connected to is responsible for the data it holds under its own privacy policy, and disconnecting from Voco does not delete anything already recorded there.

7. WhatsApp and Meta Data

Voco can answer WhatsApp messages for the businesses that use it, in two ways: on Voco's own WhatsApp number, which runs through Twilio, or on the business's own WhatsApp Business number, linked to Voco through Meta. We are rolling out linking, so it may not be available on every account yet.

To link its WhatsApp Business account, a business logs in through Meta and approves Voco's access. You cannot sign in to Voco with Facebook. Once an account is linked, we receive:

  • The connection details Meta returns: the WhatsApp Business account ID, the phone number and the access token Meta issues for the connection. We use them to receive the number's messages and send the business's replies.
  • Messages sent and received on that number, including photos and voice notes, and replies the business sends from its WhatsApp Business app. We use them to show the conversation in the business's Voco dashboard, to let its AI receptionist answer if the business has switched that on, and to know when a person has taken over a chat.
  • The contact list in the business's WhatsApp Business app, used only so that Voco does not answer people the business has saved as contacts, unless the business chooses otherwise.
  • Past chats from up to the last 6 months, only if the business chooses to import them when it links its account. We use them so the business's receptionist knows its regular customers.

We do not receive group chats.

To answer a message, Voco sends its text, any photo caption or shared location, and the written-out text of any voice note to the business's AI receptionist, run by our AI voice and messaging provider, together with the customer's WhatsApp number. Voice notes are written out by OpenAI. Photos are not sent to any AI service; the receptionist is only told that a photo has arrived. Where a business uses Voco's customer profiles, a summary of each conversation (not the messages themselves) is used to keep that customer's profile up to date for the business.

We use WhatsApp and Meta data only to provide Voco's service to the business that linked its number or uses Voco's WhatsApp number. We do not sell this data and we do not use it for advertising.

A business can unlink its account at any time from Settings in Voco, from Meta Business Settings, or from the settings in its WhatsApp Business app. Our data deletion instructions explain how to ask us to delete this data.

8. Who Is Responsible for Your Data

For the messages, calls and customer details Voco handles for a business, including WhatsApp messages, contacts and imported chats, the business is the data controller. Voco processes that data on the business's behalf and only on its instructions, under our Data Processing Agreement. If you contacted a business that uses Voco, that business decides how your data is used, and you can ask it directly about your data.

For our own customers' account, billing and support details, for our own marketing, and for people who contact Voco itself, Voco Digitals Ltd is the data controller.

Meta handles WhatsApp messages under its own terms and privacy policy. When a business links its own WhatsApp Business number, it has its own agreement with Meta for that number.

9. Service Providers

These providers handle WhatsApp and Meta data for us, each under a data processing agreement:

  • Laravel Holdings, Inc. (Laravel Cloud), United States: hosts the Voco application, its database and its job queues, where WhatsApp messages, contacts and connection details are stored, in its London region, in the UK.
  • Laravel Holdings, Inc. (Laravel Nightwatch), United States: monitors Voco's performance and errors, and stores its records in the EU (Frankfurt). Its records can include page addresses, IP addresses and, for Voco's own WhatsApp number, customers' phone numbers. It does not record the contents of requests.
  • Amazon Web Services EMEA SARL (Amazon S3), Luxembourg: stores photos, voice notes and other attachments in its London region, in the UK.
  • Our AI voice and messaging provider, United States: runs the AI receptionist. It receives message text, written-out voice notes and the customer's WhatsApp number to write a reply.
  • OpenAI OpCo, LLC, United States: writes out voice notes as text and, where a business uses customer profiles, writes the profile from conversation summaries.
  • Anthropic, PBC, United States: a backup for writing customer profiles from conversation summaries, used if OpenAI is unavailable.
  • Twilio Ireland Limited, Ireland, with Twilio Inc. in the United States: carries messages on Voco's own WhatsApp number, and texts.
  • Railsware Products Studio LLC (Mailtrap), United States: sends Voco's notification emails, which can include a customer's name, number and the start of their message on Voco's own WhatsApp number.

Other providers support other parts of Voco, such as calls, email forwarding and payments. Businesses that use Voco can ask us for our full list of sub-processors, with each provider's name and location, as set out in our Data Processing Agreement.

10. International Transfers

Voco's application, database and stored files are hosted in the UK, in London. Several of the providers in section 9 are based in the United States, so personal data may also be transferred to and processed in the United States, and Laravel Nightwatch stores its records in the EU. We rely on these safeguards:

  • Laravel Holdings, Inc., Twilio Inc. and Railsware Products Studio LLC are certified under the UK Extension to the EU-US Data Privacy Framework. Each provider's data processing agreement also includes the EU Standard Contractual Clauses with the UK International Data Transfer Addendum issued by the Information Commissioner.
  • Our AI voice and messaging provider, OpenAI OpCo, LLC and Anthropic, PBC: the EU Standard Contractual Clauses with the UK International Data Transfer Addendum issued by the Information Commissioner, as part of each provider's data processing addendum.
  • Amazon Web Services EMEA SARL: photos, voice notes and other attachments are stored in the UK. Any access from outside the UK is covered by the AWS data processing addendum and its UK GDPR Addendum, which includes the UK International Data Transfer Addendum.
  • Laravel Nightwatch's records are stored in the EU, which the UK recognises as giving adequate protection to personal data.

11. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, typically for the duration of our business relationship plus 6 years for legal and regulatory purposes.

  • WhatsApp messages, photos, voice notes and imported past chats are kept while the business uses Voco, until the business or the person they concern asks us to delete them, or the business's account is deleted. When a business's agreement with us ends, our Data Processing Agreement sets out how we delete or return its data.
  • The contact list and the access token for a linked WhatsApp Business number are deleted as soon as the business unlinks Voco, or as soon as Meta tells us the business has removed Voco's access.
  • Conversations held by the AI receptionist provider are deleted at the end of the retention period agreed for a business's conversations, where one has been set.

12. Your Rights

Under UK GDPR, you have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Erase your data ("right to be forgotten")
  • Restrict processing
  • Data portability
  • Object to processing
  • Withdraw consent at any time

To exercise these rights, contact us at hello@vocohq.co.uk. Our data deletion instructions explain how to ask us to delete your data. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

13. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption, access controls, and regular security assessments. The access token Meta issues for a linked WhatsApp Business number is stored encrypted. Where your data is stored, and how it is protected when it leaves the UK, is set out in sections 9 and 10.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

Voco Digitals Ltd
Email: hello@vocohq.co.uk
Phone: 0333 043 6661

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We value your privacy. We use cookies to understand how the site is used, and only after you accept. How we use cookies