Privacy Policy
Rivoxa AI Limited · Last updated: 16th September 2026
1. Who we are
Rivoxa AI Limited ("Rivoxa", "we", "us", "our") is a UK-based company that designs, builds, and operates AI voice and chat agents for service businesses. Our website is rivoxa.co.uk.
If you have any questions about this policy or how we handle your data, contact us at:
- Email: simeon@rivoxa.co.uk
- Post: 56 Sir John Newsom Way, Welwyn Garden City, England, AL7 4FL
- Company number: 17104231
We are the data controller for the personal data described in this policy, except where stated otherwise below (see Section 7, "When we act as a processor for our clients").
2. What this policy covers
This policy explains how we collect, use, store, and share personal data when you:
- Visit rivoxa.co.uk
- Contact us through a form, email, or phone call to enquire about our services
- Become a client or prospective client of Rivoxa
- Interact with a voice or chat AI agent that Rivoxa has built and deployed on behalf of one of our clients (see Section 7)
3. Personal data we collect
Depending on how you interact with us, we may collect:
- Contact details: name, email address, phone number, company name, job title
- Enquiry and communication data: messages you send us, call recordings and transcripts if you speak with us or with an AI voice agent we operate, and records of our correspondence
- Technical data: IP address, browser type, device information, and website usage data collected via cookies and analytics tools (see Section 6)
- Business data: information you provide about your company when discussing a potential project (e.g. call volumes, current systems, business requirements)
We do not knowingly collect special category data (e.g. health or financial details) unless you choose to provide it to us, or it is incidentally captured in a call transcript.
4. How we use your data
We use personal data for the following purposes:
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Responding to enquiries and providing quotes | Legitimate interests / pre-contract steps |
| Delivering our services under a signed agreement | Performance of a contract |
| Building, testing, and improving voice/chat AI systems for clients | Performance of a contract / legitimate interests |
| Bookkeeping, invoicing, and tax compliance | Legal obligation |
| Marketing communications (where you've opted in) | Consent |
| Website analytics and improving our site | Legitimate interests / consent (cookies) |
| Preventing fraud and misuse of our systems | Legitimate interests |
5. Who we share data with
We use a number of third-party service providers to run our business and deliver our services. These providers may process personal data on our behalf, under contractual data processing terms:
- Telephony and voice AI infrastructure: Telnyx, and (for some clients) AWS (including Amazon Bedrock) and Twilio
- Speech processing: text-to-speech and speech-to-text providers such as ElevenLabs, Deepgram, or Cartesia, depending on the system built for a given client
- Automation: Make.com
- Email and productivity: Google Workspace
- CRM: HubSpot
- Accounting: Xero
- Website hosting: AWS Amplify
Some of these providers may process or store data outside the UK/EEA. Where this happens, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.
We do not sell your personal data.
6. Cookies and analytics
Our website uses cookies and similar technologies. Some are essential for the site to work; others are only set once you accept them via the cookie banner shown on your first visit. If you accept, we use Google Ads/Analytics to measure advertising performance and Microsoft Clarity to understand how visitors use our site. You can change your choice at any time by clearing this site's data in your browser, and declining these cookies does not affect your ability to use the site.
7. When we act as a processor for our clients
Some of the personal data that passes through our systems belongs to our clients' own customers — for example, when someone calls a business that uses a Rivoxa-built voice AI agent to handle bookings or enquiries. In these cases:
- Our client is the data controller for that data
- Rivoxa acts as a data processor, handling the data only on our client's documented instructions, under a Data Processing Agreement
- If you are a customer of one of our clients and have questions about how your data was handled, please contact that business directly. We will support them in responding to your request.
8. Data retention
We keep personal data only for as long as necessary for the purposes it was collected, including to meet legal, accounting, or reporting requirements. Retention periods vary by data type (e.g. financial records are typically kept for six years to meet UK tax obligations; call recordings and transcripts are retained per the agreed terms with each client, or deleted after 90 days where we control the data).
9. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request erasure of your data
- Object to or restrict certain processing
- Request data portability
- Withdraw consent at any time, where processing is based on consent
To exercise any of these rights, contact us at simeon@rivoxa.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
10. Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including access controls, encryption in transit, and contractual safeguards with our sub-processors.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of this page reflects the most recent changes.