Who we are
Open Voice Agent Ltd operates Open Voice Agent. Our company number is 17502913 and our registered office is 71–75 Shelton Street, Covent Garden, London WC2H 9JQ.
For privacy questions, requests or complaints, contact team@openvoiceagent.com, or write to Open Voice Agent Ltd at our registered office, marking your correspondence “Privacy”.
Our public business number is 020 4524 7953. For billing enquiries, use billing@openvoiceagent.com.
This notice covers our website, our own customer accounts, billing, security, support, sales enquiries, affiliate applications, social media and communications, and explains our involvement in customer receptionist services. The current service edition is for UK businesses. UK service availability does not mean every supplier processes information only in the UK.
Our role and the customer's role
We are the controller when we decide why personal information is used to operate our own business: for example, managing accounts, administering payments, handling our own support enquiries and privacy complaints, reviewing sales enquiries and affiliate applications, arranging discussions about Open Voice Agent, protecting the service and responding through our own marketing-site assistant.
For a customer's receptionist calls, website conversations, business knowledge and enquiry records, the customer business usually decides the purposes and we act as its processor under our data-processing addendum. Its privacy notice explains its purposes, lawful bases, retention choices and caller contact route. A business processing information for another organisation needs authority from that organisation and an appropriate processing arrangement.
If your request concerns a business you contacted through Open Voice Agent, contact that business first. You may also contact us so we can identify the responsible business and assist it. We do not give you access to another customer's workspace or disclose its records without the required authority.
Suppliers can have different roles for different activities. A payment or communications provider may process some information for its own legal, security or payment purposes as well as providing a service to us.
Information we use and why
Our own controller activities
Scroll sideways to read the full table.
| Information | Purpose | Lawful basis |
|---|---|---|
| Name, business contact details, authorised-user details, account identifiers and subscription information | Set up and administer accounts, provide the agreed service and send necessary service notices | Contract where the individual is the contracting customer; otherwise legitimate interests in administering the relationship with the customer business and its authorised users |
| Billing identity, payment-provider references, invoices, payments, refunds and relevant usage records | Administer payments and disputes and keep required company and tax records | Contract or the legitimate interests described above for payment administration; legal obligation for records required by applicable company and tax law |
| Support enquiries, correspondence and complaint records | Answer questions, investigate issues, resolve complaints and establish or defend relevant legal claims | Legitimate interests in providing support and resolving issues; legal obligation where applicable, including handling data-protection complaints |
| Business-contact calls, emails and messages: contact details, necessary call-routing information and the information you supply | Respond to your enquiry, arrange requested follow-up and keep the correspondence needed to resolve it | Legitimate interests in handling business enquiries; contract where necessary for steps requested by an individual before entering a contract |
| Login/session information, IP addresses, device information and necessary security events | Authenticate users, protect accounts, prevent misuse and investigate incidents | Legitimate interests in securing the service and protecting users; legal obligation where a specific security or reporting duty requires the processing |
| Contact details and business enquiries through Open Voice Agent's forms or AI assistant; for a custom-integration request, name, business, email, optional phone, requested integration and supplied requirements/details | Answer questions about Open Voice Agent, assess a requested integration and follow up the enquiry | Legitimate interests in responding to prospective customers and assessing requested work; contract where necessary to take steps requested by an individual before entering a contract |
| Affiliate applicant name, email and introduction, plus optional business and website/social-profile URL; necessary submission references and validation/anti-abuse information | Review the application, respond to the applicant and protect the submission process | Legitimate interests in assessing prospective business relationships, handling requested applications and preventing submission abuse |
| Marketing preferences and contact details | Send permitted promotional communications and honour objections | Consent where required; otherwise legitimate interests only where the communication rules permit the activity and the person's interests and expectations have been assessed |
Our legitimate interests are limited to the purposes described in this table. Accepting subscription terms is not blanket consent to other uses of personal information. Include only information needed for an enquiry or application, rather than unrelated customer or caller records. Optional website measurement and device storage have separate requirements explained in Website storage and communications.
We obtain this information from you, your business and authorised users, our website forms and service interactions, and relevant authentication, payment and delivery events from providers. Where information is supplied by somebody else, it may include their business's account invitations, contact details or correspondence. We explain which details are required and the consequences of not providing them at the point of collection. For example, we need an account identifier to provide account access and payment information to administer a paid subscription.
Social media and advertising enquiries
If you interact with our company profiles, posts, comments, direct messages or a platform lead form, we receive the profile/contact information, message or form answers you make available to us. We use it to respond, manage our company presence and handle the requested follow-up, relying on legitimate interests or steps requested by an individual before a contract where applicable. Platform-provided audience insights can also help us assess our posts. The platform processes information under its own terms and privacy notice; some business-page or advertising functions can involve shared controller responsibilities. A public comment is visible to other people, so use our privacy contact for a sensitive request.
Following our profile, sending an enquiry or completing a lead form does not itself authorise unrelated promotional messages or customer-list advertising. If an enabled form separately requests marketing permission, its wording identifies the purpose and channel. Advertising data and choices are explained in Website storage and communications.
Information processed for customer businesses
The enabled service can process caller telephone numbers, names, supplied email/contact details, live audio, transcripts and conversation text; enquiry summaries, tickets, notes and history; call/chat times and outcomes; transfer and message delivery records; permission and suppression evidence; and customer-supplied FAQs, documents and website information. Saved audio depends on the customer's enabled recording configuration. A call to Open Voice Agent's company contact number is our own business-contact activity, distinct from a customer's receptionist service.
This information is used for the customer's documented purposes and instructions: answering routine enquiries, recording a message, arranging a callback, routing an authorised transfer or delivering a permitted requested message. The customer's contract with Open Voice Agent does not itself supply a lawful basis for every caller.
We do not use a customer's caller information as Open Voice Agent's marketing contact list. Any use of customer content for a separate model-training or service-development purpose needs its own documented assessment, lawful basis, notices and contractual authority; a general reference to “improving the service” does not supply them.
AI, calls and sensitive information
The receptionist and website assistant are AI services. Their responses, transcriptions and summaries may contain errors. Contact the business concerned, or Open Voice Agent for Open Voice Agent's own assistant, to correct information or use the alternative contact route shown with the service.
Before you start an AI conversation, the entry notice explains that it is AI, the relevant provider processing and the recording arrangements. ElevenLabs, its affiliated companies and supporting providers process the interaction. Text messages and voice transcripts can be retained; where saved voice recording is enabled, voice audio is also saved. Live audio still has to be processed to understand a voice interaction even if saved audio is disabled. The responsible business's information explains its purposes, retention and alternative contact route.
When enabled, Open Voice Agent's own website assistant uses Qwen3.5-397B-A17B hosted by ElevenLabs for responses and Google Gemini 2.5 Flash for conversation analysis. Default backup options may use Google, OpenAI or Anthropic models. Its text messages and voice transcripts are recorded and retained to handle your enquiry; using voice also saves the voice audio. The customer receptionist's response, analysis, speech and backup providers are identified in its entry notice and applicable supplier information. A potential backup is not a statement that every provider processes every interaction.
“Continue” acknowledges the entry notice. Any separately required consent or agreement is requested separately. You can use the alternative contact route without starting the assistant.
The ordinary service is for business reception, rather than medical, financial or legal advice or emergency handling. Do not submit full payment-card details, passwords or information outside the permitted service scope. Sensitive or regulated uses must be assessed and authorised separately under the applicable law and provider agreements.
An ordinary enquiry can unexpectedly include health information or other special-category data. We do not treat a warning, a continued conversation or a request for help as explicit consent to use that information for other purposes. We limit access and further use, and arrange appropriate handling with the responsible business. Customer-controlled processing needs the customer's lawful basis and applicable Article 9 condition and DPA 2018 safeguards. Where Open Voice Agent itself needs special-category information to establish, exercise or defend a legal claim, we rely on legitimate interests and Article 9(2)(f), limited to information necessary for that claim. Other intended sensitive uses need a separately identified lawful route before they begin. Criminal-offence information has separate Article 10 and DPA 2018 conditions.
Ordinary audio or transcription is not automatically biometric identification. Using a voice to identify someone uniquely would require separate information and safeguards; it is outside the ordinary receptionist service.
The ordinary receptionist does not determine eligibility for credit, employment, healthcare or similar significant matters. If a service is changed to make solely automated decisions with legal or similarly significant effects, its information and safeguards must address the applicable automated-decision rules before that use begins.
AI-assisted setup and website imports
We use AI to help extract and organise information from website pages, documents and answers supplied or authorised during setup. Relevant inputs, extracts and suggested settings are processed by the providers identified for that feature; an AI assistant's voice provider is not necessarily the provider used for imports. We limit inputs to the setup purpose and ask an authorised user to review important business facts and proposed actions. Imported pages are source material, not authority to override permissions or security controls.
Information about the account relationship is processed for account administration; customer-controlled business knowledge follows the customer's documented service instructions. A website being publicly accessible does not itself authorise every collection, reuse or marketing purpose. Do not submit third-party material without the necessary authority, or include unrelated personal information. The providers involved depend on the feature and its configuration. We identify the relevant processing providers and limit inputs to that feature’s purpose. We do not treat setup or import as permission for unrelated model training.
Website storage and communications
Our cookie and storage information explains the technologies enabled on each surface, their purposes and durations, and the available controls. This includes relevant cookies, localStorage, identifiers and embedded services. Storage essential to a requested service can be exempt from consent. Other uses require consent unless they meet a specific statutory exception.
Where measurement uses the statistical exception, it is limited to aggregate information for improving our service, with clear information and a simple free way to object. Individual session replay or retained identifiable journeys for analytics cannot use that exception. Advertising and other tracking need their applicable permissions.
Requested service messages are separate from promotion. A requested callback, service notice or permitted link does not enrol someone in marketing. Contact details supplied for a sales enquiry or affiliate application are not consent to unrelated promotion. We honour direct-marketing objections and applicable messaging opt-outs. Withdrawing optional marketing or measurement consent does not cancel your subscription or affect the lawfulness of earlier processing.
We use advertising services to reach prospective customers and measure campaigns. Advertising measurement, remarketing and audience matching follow the applicable privacy choices; the collection notice identifies the relevant platform, data, purpose and controls. This can involve campaign/click identifiers, permitted site events and, for separately disclosed customer-list matching, contact details in hashed form. Hashing is not anonymisation. Non-exempt advertising storage/access waits for consent; any related personal-data use must have its applicable lawful basis and meet the platform's requirements. Campaign placement and website tracking are separate activities with their respective data and choice controls.
Cookie permission is not blanket permission to upload an enquiry or contact list to an advertising platform. Customer-controlled caller records, conversations and imported business content are not used as Open Voice Agent's advertising audiences. You can object to direct marketing, including related profiling, at any time by contacting our privacy address. We stop the use covered by your objection and retain only the limited preference information needed to respect it and any other justified record.
Retention, deletion and security
We retain useful information for specified lawful purposes, using category-specific periods or meaningful review criteria. Full audio and transcripts may be needed to check what was requested or promised, correct an error, handle continuing enquiries or resolve a complaint. We review whether that detail is still needed when the enquiry is resolved, follow-up ends or the relevant relationship or purpose changes. An active subscription alone does not justify keeping every recording indefinitely. The relevant criteria are:
Scroll sideways to read the full table.
| Category | Retention criterion |
|---|---|
| Open Voice Agent account and authorised-user information | Account administration during the relationship, followed by the limited information needed to complete closure and meet separately identified obligations or claims |
| Billing, invoice and dispute records | The applicable statutory recordkeeping period; records needed for an actual dispute or legal claim are retained separately for that purpose |
| Open Voice Agent contact, support and complaint correspondence | Resolution and necessary follow-up/evidence, with a review when the matter closes and when any relevant legal retention need ends |
| Open Voice Agent sales and custom-integration enquiries | The period justified by the requested follow-up and assessment, reviewed when the enquiry closes; any subsequent customer relationship or necessary claim record has its own purpose |
| Affiliate application records | Application review, decision and necessary follow-up, reviewed when the application closes; any later accepted relationship or necessary claim record has its own purpose |
| Security and access events | The period justified by the specific prevention, investigation or accountability purpose, followed by deletion or irreversible anonymisation |
| Marketing contact and suppression records | While permission and a current justified marketing purpose remain, with review for stale contacts and earlier withdrawal or objection; limited evidence or suppression records may remain to respect the person's choice |
| Customer audio, full transcripts and enquiry/service history | Open enquiry handling and follow-up; afterwards, only the detail needed for a documented continuing service-history, accuracy or complaint purpose. Review at enquiry/follow-up closure, the end or change of the relevant relationship/purpose, settings changes and applicable requests/instructions. Actual supplier expiry and necessary exceptions are disclosed |
| Customer knowledge and source material | During instructed service use, with replacement/removal review and return or deletion at the end of processing according to the customer's choice, deleting copies unless UK law requires storage |
| Backups | The defined recovery cycle, with deleted information put beyond ordinary use pending expiry and deletion reapplied before restored information returns to use |
Social correspondence and lead enquiries follow the relevant contact/enquiry criteria. Where enabled, setup source copies and derived knowledge follow the instructed knowledge lifecycle; identifiable advertising events and audience memberships are limited to the disclosed campaign purpose and period, with review at campaign expiry, withdrawal or objection. Necessary consent and suppression evidence is retained separately to respect choices, without retaining unrelated conversation content.
Cancelling a subscription, archiving a ticket and erasing personal information are different actions. At the end of customer processing, we return or delete the customer's personal data and copies according to its choice, unless UK law requires storage. A valid erasure request may require deletion or irreversible anonymisation across linked records and relevant providers. An exit/export window does not postpone an earlier lawful erasure instruction or reset an existing shorter expiry. Necessary exceptions are explained; they do not justify retaining unrelated information indefinitely.
Genuinely anonymous aggregate information can preserve insights for the long term where the underlying processing and contract permit it. Removing a name while retaining a linkable identifier, recognisable voice or identifying conversation does not necessarily anonymise the record. A customer processing agreement does not automatically authorise Open Voice Agent to keep or train on identifiable customer content for its own future purposes.
Measures protecting information must be appropriate to the risks, including authorised access, confidentiality and recovery. No internet or telephone service is risk-free. We assess security incidents and make the notifications required by the law applicable to the incident. A regulator's reporting deadline does not postpone Open Voice Agent's obligation to notify a customer controller without undue delay of a breach affecting its information.
Rights and complaints
Depending on the processing and applicable conditions, you may request access, correction, erasure, restriction or portability, object to processing, withdraw consent, or exercise safeguards concerning significant solely automated decisions. Erasure and portability are not available in every circumstance. An objection to direct marketing must be respected.
You may make a request verbally or in writing. You do not need an active subscription or prescribed form, and should not send us your password. We may request proportionate information to establish identity and locate the relevant records while protecting other people's information.
For requests we handle as controller, we respond without undue delay and normally within one month. Where the law permits an extension because requests are complex or numerous, we may take up to two additional months and explain the extension and reasons within the initial month. Any identity requirement or clarification affecting the clock must satisfy the applicable legal conditions; we do not require you to narrow a request merely for convenience.
For customer-controlled records, we assist the customer with its response rather than replacing its responsibility or answering without authority.
For a data-protection complaint, we provide a usable route, acknowledge receipt within 30 days, make appropriate enquiries, keep you informed and communicate the outcome without undue delay. This acknowledgment period is different from the period for responding to a rights request. You can also complain to the ICO.
Changes
We identify the current version when this notice is published. Where required, we explain material changes affecting existing processing before they take effect, including relevant changes in purpose, recipients, recording or retention.