Data Privacy Policy

01 Who we are

Vault and Key Ltd ("Vault and Key", "we", "us") provides an AI telephone reception service. We are a company registered in England and Wales, company number 16493464, registered office 39 Newlands, Kings Sutton, Banbury, England, OX17 3QH.

For any privacy question or to exercise your rights, contact elliot@vaultandkey.com.

02 Controller and processor roles

For personal data about our subscribing businesses (your account and billing details), we act as the controller.

For personal data about callers who reach a client's line through our Service, the subscribing business is the controller and we act as their processor, handling that data on their documented instructions.

03 The data we collect

• Business account data — business name, contact name, email, phone, billing details (card payments are handled by Stripe), plan selection.
• Call data — call audio and/or transcripts, and caller-provided details such as name, phone number, postcode/job address and the nature of the enquiry.
• Usage data — call volume, timing and outcomes used for your reporting.
• Website data — details you submit through our forms (business name, email, phone, any message), and limited technical data needed to serve and secure the site. Form submissions are delivered to us by email and are also held in our website host's form system (Netlify) until we delete them.
• Onboarding information — what you tell us on the setup forms so we can build your line: your services, pricing, policies, tools and how you want calls handled.

04 How we use data, and our lawful bases

We do not sell business or caller data.

05 Call recording & AI handling

Calls to a client's line are answered by an AI assistant and may be recorded and/or transcribed to provide the Service. Subscribing businesses are responsible for informing their callers of this and obtaining any consent required by law; we provide suitable notice wording to support that.

06 Sharing & sub-processors

We share data only with service providers who help us run the Service, under contract and on our instructions. Current categories of sub-processor:

• Telephony & call orchestration — Vapi.
• Voice synthesis — ElevenLabs.
• Automation / workflow — Make (Integromat).
• AI / speech & language models — our model and speech-to-text providers.
• Website & form hosting — Netlify.
• Payment processing — Stripe. Card details are entered with Stripe and are not stored by us.
• Email delivery — our transactional email provider.

International transfers. Some providers process data outside the UK. Where they do, we rely on an appropriate safeguard — a UK adequacy decision, or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses — so your data stays protected. A current sub-processor list is available on request at elliot@vaultandkey.com.

07 How long we keep it

• Account & billing records — for the life of your subscription, then for 6 years after the end of the financial year they relate to, to meet tax and company-law record-keeping obligations.
• Call audio recordings — 90 days, then deleted.
• Call transcripts and job summaries — 12 months from the call, then deleted. Clients can ask us to delete a record sooner.
• Website enquiries (contact form) — up to 12 months if you do not become a client; if you do, the details move into your account record.
• Newsletter sign-ups — until you unsubscribe.

These are the standard periods. A different period may be agreed with a client in writing.

08 Storage & security

Data is encrypted in transit and, where appropriate, at rest. Access is restricted to authorised personnel and to the integrations you enable. We maintain organisational and technical measures appropriate to the risk, and have procedures to detect and respond to personal data breaches.

09 Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent where processing is based on it. To exercise any right, contact elliot@vaultandkey.com. Where we act as a processor for a client's callers, we will pass such requests to the relevant client and assist them in responding.

10 Cookies

We use only the cookies and similar technologies strictly necessary to serve and secure the website. If we introduce analytics or other non-essential cookies, we will ask for your consent first and update this policy.

11 Complaints

If you have a concern about how we handle your data, please contact us first at elliot@vaultandkey.com. You also have the right to complain to the Information Commissioner's Office (ICO) — ico.org.uk, helpline 0303 123 1113.

12 Changes to this policy

We may update this policy periodically. Material changes will be communicated to account holders before they take effect, and the "last updated" date above will change.