Voxra Privacy Policy

Voxra is a trading name of IQ Mobile Limited (company number 09411131), Unit 5, Riverside Court, Bath, BA2 3DZ. For personal data about our customers and website visitors, we are the controller. ICO registration: ZB266732.

For personal data about the people who call or message our customers' businesses ("callers"), the business using Voxra is the controller and we act as its processor. If you called a business that uses Voxra and have a question about your data, please contact that business first — we will help them respond. You can also contact us at help@helloiq.uk.

About our customers (account holders):

• account details — name, business name, email address, mobile number, password (stored hashed);
• business information you give Voxra — services, prices, hours, service area, website content we read at your request, including the website or directory page (such as Checkatrade or Facebook) you give us when you sign up, which we read straight away to fill in your setup;
• for estate and letting agents, the property listings on your own website or the listings feed you give us (address, price or rent, status, features and links to the brochure, floorplan and EPC), which we read every few hours so Voxra can answer questions about them; we never read the property portals;
• your setup chat with Voxra on WhatsApp or by text (what you tell it and what it replies), whether you agreed to setup messages (when, and the wording you were shown) and, if you opt out, when;
• voice notes you send Voxra on WhatsApp (in the setup chat, or when you run your business by message): they are transcribed by Telnyx so Voxra can read and reply to them, and the words are kept with the chat; the audio is not kept;
• billing details — plan, invoices and payment status (card and bank details are held by our payment providers, not by us);
• usage — calls handled, AI minutes used, app and website activity, device push tokens;
• records of your acceptance of our terms (version, time and the IP address and browser used);
• if you move an existing landline to Voxra, the Customer Letter of Authority you sign: your current provider, the numbers and the address where the line is installed, the details on your phone bill (company name, billing address, company number, account number), your name, job title, email and signature, and — if you sign on screen — the time, your IP address and the email address of your Voxra login.

About callers, on our customers' behalf:

• audio recordings of calls answered by the AI receptionist (unless the business has switched recording off) and of voicemails, transcripts of those calls, and summaries generated from them;
• calls the business answers itself on its Voxra number or eSIM are not recorded, unless a Pro or Complete business turns on "Voxra listens to calls you answer". Then the incoming calls it answers are recorded (the caller hears "This call may be recorded" before being connected; calls the business makes are not recorded), transcribed and summarised, and the follow-ups heard on the call — quotes to send, jobs to book, contact details to save — are drafted for the business to check;
• caller phone number, name, address or postcode (the full address for a job at their home), email address if they give one, and the details of the job or enquiry they give;
• appointments booked, the confirmations and reminders sent to callers about them by text or email, messages sent and received (SMS, WhatsApp), and notes the business adds;
• for callers of an estate or letting agent: the properties they ask about, the details sent to them, viewings booked, their feedback after a viewing, and any offer they make (the amount, their position — for example a mortgage agreed in principle, a chain or a cash buyer — any conditions, and the time), which are passed to the agent straight away and kept on the agent's records;
• enquiry emails a business forwards to its Voxra lead inbox (from property portals such as Rightmove, Zoopla and OnTheMarket, online valuation tools, trade directories such as Checkatrade, Bark, MyBuilder and TrustATrader, or its own website's forms): the email itself, the enquirer's name, phone number, email address, the property or job they asked about and their message, and the text or email Voxra sends them for the business;
• WhatsApp voice notes a customer sends to a business that uses Voxra: they are transcribed by Telnyx so the business's assistant can read and reply to them, and the transcript is kept with the conversation, where the business sees what was said. Neither Telnyx nor Voxra keeps the audio;
• quotes the business sends with Voxra: the voice note the business records to create it (audio and transcript), the quote itself (the customer's name, email address and mobile number, the work and prices), and, when the customer accepts or declines it online, their name, the time, their IP address and browser, and any message they leave.
• payments for a job the business takes with Voxra (Tap to Pay in the app, or a payment link): the amount, the time, the booking or quote it was for, which team member took it, whether it succeeded, was declined or refunded, the card's brand and last four digits as Stripe reports them (never the full card number), and, if the customer asks for a receipt, the mobile number or email address it was sent to.

• to provide Voxra — answering calls, booking, messaging and billing (contract);
• to send callers the service messages the business uses Voxra for, such as a text or email confirming an appointment the AI receptionist has just booked for them (with the business's number to change or cancel it), appointment reminders, a payment link for a job, and a receipt for a card payment when the customer asks for one. We send these for the business, as its processor; they are never marketing, and a business can switch booking confirmations off;
• to reply to people who sent a business an enquiry that the business forwards to its Voxra lead inbox: we read the email for the business, add the enquirer to its leads and, unless the business has chosen to log enquiries only, send the enquirer one text from the business's Voxra number (or an email if there's no mobile number) about what they asked for — such as booking a viewing, a valuation or a visit — and the business's assistant answers if they reply. We do this as the business's processor; the business is the controller and relies on the enquirer having asked it to get in touch. We never send these texts between 9pm and 8am (they wait until 8am), never to anyone who has replied STOP, and they are never marketing;
• for businesses that turn on "Voxra listens to calls you answer": to record, transcribe and summarise the calls they answer themselves and draft their follow-ups. The business, as controller, relies on its legitimate interests in keeping accurate records of its own customer calls and following them up; callers are told the call may be recorded before it is connected;
• to keep the service secure, prevent fraud and abuse, and fix problems (legitimate interests);
• to review a small sample of calls to improve how Voxra answers (legitimate interests — you can ask us not to include your calls);
• for estate and letting agents: to send an applicant the property details they ask for and, the day after a viewing, one message asking how it went (the agent can switch this off, and replying STOP stops it); and, if the agent chooses, to email a summary of each call or chat to the address their own property software imports enquiries from. We do this for the agent, as its processor (contract; the agent's legitimate interests);
• for businesses that visit their customers, to estimate the drive between one job and the next from the jobs' postcodes, so the diary leaves enough time to travel (contract);
• to send service emails such as confirmations, trial reminders and important changes (contract);
• to welcome you and help you set up on WhatsApp (or by text if you're not on WhatsApp) at the mobile number you give when you sign up: a welcome message, the setup questions, a reminder or two if setup isn't finished, and updates on moving your number if you ask for that in the chat. These are service messages about your account, never marketing. You can say no when you sign up, or reply STOP at any time, and we'll use email instead. WhatsApp messages are carried by Telnyx and Meta's WhatsApp Business Platform (contract and legitimate interests);
• if you came to voxra.uk from one of our adverts on Facebook, Instagram or Google: to tell that platform that the advert led to a free trial, and later to a paying customer, so we can see which adverts work and stop paying for the ones that don't; and, for Facebook and Instagram adverts, that you opened our page from the advert, so a follow-up advert can be shown to people who looked but didn't start a trial (legitimate interests);
• if you accept advertising cookies on our public pages: to let the Meta Pixel tell Meta which of our pages you visit, so we can measure our adverts and show them to people who have visited (consent — withdraw it at any time with "Cookie settings" at the bottom of any page). See "Advert measurement" in section 4. You can object at any time;
• to move a number you ask us to port: we send your signed Letter of Authority and its details to our network partner Magrathea and, through them, to your current provider (contract); we keep it afterwards because the UK porting process requires the gaining provider to hold it and produce it if asked (legal obligation);
• to meet legal obligations such as tax, telecoms and law-enforcement requirements (legal obligation).

We do not sell personal data and we do not use callers' data to train third-party AI models.

We use these providers (sub-processors) to run Voxra. Where each one keeps or processes the data is shown in brackets:

• IQ Mobile's own systems — our telephony servers (PBX), which route calls and hold voicemail and call records, plus billing and mobile network services, and a copy of the signed Letter of Authority for a number you port in (UK — London);
• Magrathea Telecommunications — our UK network partner for landline numbers: when you port a number in, they receive your signed Letter of Authority and its details and pass what is needed to your current provider (UK);
• Supabase — our main database, including transcripts, summaries, contacts and bookings, and account sign-in (UK — London);
• Vercel — website and application hosting; the application runs in London, and the website is served from Vercel's global network (UK, with global delivery);
• Akamai (Linode) — storage of AI call recordings, of calls a business answers itself when it has turned on "Voxra listens to calls you answer", and of voice notes recorded to create quotes, all deleted after 10 days, and, in a separate store, the signed Letters of Authority for numbers you port in, deleted after 13 months (UK — London);
• Telnyx — telephony, SMS and WhatsApp messaging, speech-to-text (including transcribing voice notes; the audio is not kept) and the AI voice receptionist, including a copy of each conversation's transcript, deleted after 10 days. Telnyx stores its call and message records and records AI-answered calls in Germany (EU) while running the AI; we move each recording to our UK storage straight after the call and Telnyx's copy is deleted within minutes. Telnyx may process some data, such as the AI conversation history, in the USA (EU and USA);
• Vercel AI Gateway, with Baseten and Fireworks AI — AI language models used to summarise calls, reply to messages, read your website, turn your voice notes into quotes, pick out the follow-ups from calls a business answers itself and read enquiry emails forwarded to a lead inbox; they do not keep the content (USA);
• xAI, through the Vercel AI Gateway — speech-to-text for the calls a business answers itself, only when it has turned on "Voxra listens to calls you answer". It is used under a zero-data-retention arrangement, so the audio isn't kept (USA);
• Firecrawl — reads a web page you ask us to import (your website or directory page, such as Checkatrade) when we can't read it directly; it receives the page's address and returns the page's public text (USA);
• Resend — account and service emails, the quotes and payment links you send to your customers, booking confirmation emails to callers who give an email address, payment receipts a customer asks to have emailed, and receiving the enquiry emails a business forwards to its Voxra lead inbox (and Voxra's email reply to an enquirer with no mobile number) (USA, with emails received in the EU — Ireland);
• Stripe — card payments for your Voxra subscription and, if you set up in-call deposits, the payment account we create for your business: we give Stripe your business name, website and email, Stripe collects the verification and bank details it needs from you directly, and your callers pay on Stripe's page (we only receive the payment's status and amount, never card details). The caller's mobile number is not sent to Stripe. When a business takes a card in person with Tap to Pay in the Voxra app, the card is read and sent straight to Stripe by Stripe's own software on the phone, which also checks the phone's location; we receive the payment's status and amount and the card's brand and last four digits (UK/EU and USA);
• GoCardless — Direct Debit payments (UK/EU);
• Ahrefs — visit statistics for our public web pages (not your Voxra account). It uses no cookies and never stores IP addresses or other personal data (Singapore);
• Expo — push notifications to the Voxra mobile app (USA);
• Google — only if you connect Google Calendar, to check availability and add bookings (USA and other Google locations);
• Google Maps Platform (Routes API) — for businesses that visit their customers, to estimate drive times between jobs. Only postcodes are used, sent as map points (latitude and longitude) — never names, street addresses or details of the job. Results are kept by postcode area for 30 days so the same journey isn't looked up again (USA and other Google locations);
• postcodes.io (Ideal Postcodes) — to turn a job's postcode into a map point for those drive-time estimates. Only the postcode is sent (UK);
• Microsoft (Microsoft 365 / Microsoft Graph) — only if you connect Outlook, to check availability and add, move or cancel the bookings Voxra makes; your calendar data stays in your own Microsoft 365 region (for UK organisations, normally the UK);
• Xero — only if you connect Xero, to add your customers and create draft quotes, invoices and deposit payments in your Xero organisation. Xero data is never used to train AI (USA);
• Cliniko (Red Guava) — only if you connect Cliniko, to read your clinic's free times, find or add the patient who called (their name and phone number) and book, move or cancel the appointments Voxra makes. The data stays in your Cliniko account's region (for UK accounts, the UK).;
• Square (Block) — only if you connect Square, to read your services, free appointment times, items, prices and stock, find or add the caller (their name and phone number) as a Square customer, and book, move or cancel the appointments Voxra makes. Square may send your customer its own booking messages, as set in your Square account (USA and other Square locations);
• Wix — only if you connect Wix Bookings, to read your services and free times, find or add the caller (their name and phone number) as a contact on your Wix site, and add, move or cancel the bookings Voxra makes (USA and Ireland; Wix may also use its other data centres);
• Meta (WhatsApp Business Platform, Cloud API) — only if you connect your own WhatsApp Business number to Voxra: to receive your customers' WhatsApp messages to that number, send Voxra's and your replies, and show and update the number's business profile and message templates. Meta keeps messages only as long as it needs to deliver them, at most 30 days. The access Meta gives Voxra to your WhatsApp account is stored encrypted and deleted when you disconnect the number or close your account (USA, EU and other Meta locations);
• Meta (Instagram API) — only if you connect your Instagram professional account to Voxra: to receive your customers' Instagram direct messages to that account, their Instagram name and username, and send Voxra's and your replies. The access Instagram gives Voxra is stored encrypted and deleted when you disconnect Instagram or close your account (USA, EU and other Meta locations).

Advert measurement: if you started a free trial after clicking one of our adverts, we tell the platform that showed it. For Facebook and Instagram adverts we send Meta Platforms Ireland the click reference from the advert's link, a one-way scrambled (SHA-256 hashed) copy of your email address, and the browser and IP address you signed up from; for Google adverts we send Google only the click reference; for adverts in ChatGPT we send OpenAI the click reference, a one-way scrambled copy of your email address, and the browser and IP address you signed up from. We send it when the trial starts and again if you become a paying customer, and nothing about what you do in Voxra. When you open one of our pages from a Facebook or Instagram advert, we also tell Meta that the advert's click reached the page (the click reference, the page, and your browser and IP address), so Meta can show a follow-up advert to people who looked but didn't start a trial. If you didn't arrive from that platform's advert, it gets nothing. This part works without cookies; the Meta Pixel (section 8) runs only if you accept cookies, and then Meta Platforms Ireland is a joint controller with us for what it collects. To object, email us and we'll stop (USA, EU and other Meta, Google and OpenAI locations).

Where a provider processes data outside the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Agreement / Addendum to protect it.

We may also share data where required by law, or with a buyer if the Voxra business is sold.

• call audio — AI call recordings, recordings of calls a business answers itself (when it has turned on "Voxra listens to calls you answer") and voicemails: 10 days, then deleted automatically. Call recordings are held in the UK; Telnyx's own copy of an AI call recording is deleted within minutes of the call. Need it kept longer for a specific case? Get in touch and we'll arrange it;
• voice notes recorded to create quotes: the audio 10 days, held in the UK, then deleted automatically; the transcript and the quote are kept with the customer's other records (below);
• enquiry emails forwarded to a business's Voxra lead inbox: the email's text 90 days, then deleted automatically (emails that turned out not to be enquiries are deleted entirely); the lead Voxra made from it is kept with the business's other records (below);
• messages to Voxra's own WhatsApp or text number from someone without a Voxra account (for example trying the demo): 90 days after the last message, then deleted automatically;
• WhatsApp voice notes sent to a business that uses Voxra, or to Voxra itself: the audio is not stored — it is fetched once to be transcribed by Telnyx, which does not keep it (WhatsApp and our messaging providers hold a message's media only as long as they need to deliver it). The transcript is kept with the conversation, like the transcripts below;
• transcripts, summaries, contacts and bookings: for as long as the customer's account is open, then deleted 90 days after it closes — or sooner if the customer asks us to. An account closes when its subscription is cancelled, or when a free trial ends without a subscription starting;
• call detail records (who called whom, when and for how long) and account and billing records: for the life of the account and then 6 years, to meet tax, accounting and telecoms obligations;
• terms acceptance records: 6 years after the account closes;
• signed Letters of Authority for porting a number in, and the details on them: 13 months from when you sign, then deleted automatically, even if your account closes sooner. The UK porting process requires the provider gaining a number to keep the Letter of Authority for at least 12 months and to produce it if the losing provider asks. Held in the UK.

Customers can download or delete everything held about an individual caller from that caller's page in their account at any time; this also deletes that caller's call recordings.

Under UK GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to how we use it, and to data portability. Where we rely on consent you can withdraw it at any time.

To use these rights, email help@helloiq.uk. We will reply within one month. If you called a business that uses Voxra, we will pass your request to them as the controller and help them respond.

If you're unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) — we'd appreciate the chance to put it right first.

Data is encrypted in transit, access is limited to staff who need it, and tokens and API keys for services you connect (such as Google, Microsoft, Cliniko, Wix or Square) are encrypted at rest. No system is perfectly secure; if a breach affects your data we will tell you and the ICO as the law requires.

voxra.uk uses the cookies needed to keep you signed in, remember your display preferences and, if you arrived through a referral link, remember who referred you. These are always on because the site needs them.

Advertising cookie, only if you accept: on our public pages a small banner asks whether we may use the Meta Pixel and Meta's advertising cookie (_fbp, kept for up to 90 days). If you accept, the Pixel tells Meta which of our pages you visit, from your browser, so we can see which adverts lead to visits and sign-ups and show our adverts to people who have visited. If you reject, or don't answer, neither is loaded. We remember your answer in a cookie of our own (voxra_consent) for 6 months, and you can change it at any time with "Cookie settings" at the bottom of any page; rejecting later deletes Meta's cookie from our site. The Pixel is never loaded inside your Voxra account. Advert measurement in section 4 doesn't depend on it: it uses the click reference in the advert's own link.

To count visits to our public pages we use Ahrefs Web Analytics, which works without cookies and doesn't store your IP address or anything that identifies you. It isn't loaded inside your Voxra account.

We'll update this page when things change and tell customers about material changes by email. The date and version at the top show when it last changed.