Vault and Key ← Back to site

Legal — Data & privacy

Data Privacy Policy

Last updated — [DATE]

01 Who we are

[LEGAL ENTITY NAME] ("Vault and Key", "we", "us") provides an AI telephone reception service. We are a company registered in England and Wales, company number [COMPANY NUMBER], registered office [REGISTERED OFFICE ADDRESS].

We are registered with the Information Commissioner's Office (ICO), registration number [ICO REGISTRATION NUMBER]. For any privacy question or to exercise your rights, contact [PRIVACY EMAIL].

02 Controller and processor roles

For personal data about our subscribing businesses (your account and billing details), we act as the controller.

For personal data about callers who reach a client's line through our Service, the subscribing business is the controller and we act as their processor, handling that data on their documented instructions under our Data Processing Addendum.

03 The data we collect

  • Business account data — business name, contact name, email, phone, billing details, plan selection.
  • Call data — call audio and/or transcripts, and caller-provided details such as name, phone number, postcode/job address and the nature of the enquiry.
  • Usage data — call volume, timing and outcomes used for your reporting.
  • Website data — details you submit through our forms (business name, email, phone, any message), and limited technical data needed to serve and secure the site.

04 How we use data, and our lawful bases

Provide the Service
Performance of our contract with you (UK GDPR Art. 6(1)(b)).
Handle callers' data for you
On your instructions as your processor; your lawful basis as controller applies.
Billing, security, fraud prevention, service improvement
Our legitimate interests (Art. 6(1)(f)), balanced against your rights.
Legal, tax and accounting obligations
Legal obligation (Art. 6(1)(c)).
Marketing emails / newsletter
Your consent (Art. 6(1)(a)); withdraw any time via the unsubscribe link.

We do not sell business or caller data.

05 Call recording & AI handling

Calls to a client's line are answered by an AI assistant and may be recorded and/or transcribed to provide the Service. Subscribing businesses are responsible for informing their callers of this and obtaining any consent required by law; we provide suitable notice wording to support that.

06 Sharing & sub-processors

We share data only with service providers who help us run the Service, under contract and on our instructions. Current categories of sub-processor:

  • Telephony & call orchestration — Vapi.
  • Voice synthesis — ElevenLabs.
  • Automation / workflow — Make (Integromat).
  • AI / speech & language models — our model and speech-to-text providers.
  • Website & form hosting — Netlify.
  • Email delivery — our transactional email provider.

International transfers. Some providers process data outside the UK. Where they do, we rely on an appropriate safeguard — a UK adequacy decision, or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses — so your data stays protected. A current sub-processor list is available on request at [PRIVACY EMAIL].

07 How long we keep it

  • Account & billing data — for the life of your subscription, then up to [6] years to meet tax and legal obligations.
  • Call recordings & transcripts — retained for [12] months (or the period set in your agreement), then deleted.
  • Website enquiries — kept only as long as needed to respond and, if you become a client, moved into your account record.

Retention periods are confirmed in your agreement and our Data Processing Addendum.

08 Storage & security

Data is encrypted in transit and, where appropriate, at rest. Access is restricted to authorised personnel and to the integrations you enable. We maintain organisational and technical measures appropriate to the risk, and have procedures to detect and respond to personal data breaches.

09 Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent where processing is based on it. To exercise any right, contact [PRIVACY EMAIL]. Where we act as a processor for a client's callers, we will pass such requests to the relevant client and assist them in responding.

10 Cookies

We use only the cookies and similar technologies strictly necessary to serve and secure the website. If we introduce analytics or other non-essential cookies, we will ask for your consent first and update this policy.

11 Complaints

If you have a concern about how we handle your data, please contact us first at [PRIVACY EMAIL]. You also have the right to complain to the Information Commissioner's Office (ICO) — ico.org.uk, helpline 0303 123 1113.

12 Changes to this policy

We may update this policy periodically. Material changes will be communicated to account holders before they take effect, and the "last updated" date above will change.