Privacy Policy
Effective date: 24 August 2026
This Privacy Policy explains how JD Web Services Ltd trading as The Voice Concierge collects, uses, shares, stores and protects personal data when people visit our website, contact us or use our services.
It applies to The Voice Concierge, Text Concierge, Booking and Lead Capture, Conversational Sales, Review Management, Store Sync and related websites, dashboards, integrations and support services.
Store Sync users should also read the Store Sync Privacy Notice, which provides product-specific information.
Contents
- Who we are
- Our controller and processor roles
- Personal data we collect
- Website and cookie data
- Account, enquiry and support data
- AI, voice, chat and messaging data
- Billing and subscription data
- Store Sync data
- How we obtain personal data
- How we use personal data
- Lawful bases
- AI processing and automated decisions
- Who receives personal data
- Subprocessors and service providers
- International transfers
- Data retention
- Security
- Marketing and electronic communications
- Your rights
- Children
- Third-party websites and platforms
- Changes to this policy
- Complaints and contact
1. Who we are
The organisation responsible for this Privacy Policy is:
JD Web Services Ltd trading as The Voice Concierge
Registered in England and Wales
Company number: 11453166
Registered office: 104 High Street, Mold, Flintshire, CH7 1BH
Email: [email protected]
2. Our controller and processor roles
We act as a controller when we decide why and how personal data is used, including data relating to:
- Website visitors
- Prospective customers and enquiries
- Our customers, authorised users and business contacts
- Account administration, security, billing and support
- Our own marketing, service improvement and legal obligations
We may act as a processor when a customer uses our Services to process personal data about its own contacts, website visitors, leads, callers, shoppers or customers. In that situation:
- Our customer is normally the controller
- We process the data to provide the contracted Service and follow the customer’s documented instructions
- The customer is responsible for its lawful basis, notices, consents and responses to individuals
- Our Data Processing Agreement governs the processing
We may still act as an independent controller for limited related purposes such as account security, fraud prevention, billing records and legal compliance.
3. Personal data we collect
Depending on how the Services are used, we may process:
- Name and job title
- Business or organisation name
- Email address and telephone number
- Postal and billing address
- Account and authorised-user details
- Enquiry, booking and support information
- Website, cookie and analytics data
- IP address, device, browser and operating-system information
- Voice, chat, email, SMS and other message content
- Transcriptions and AI interaction data
- CRM contact identifiers, tags and workflow activity
- Subscription, invoice, payment-reference and usage information
- Store, product, stock, order and checkout information for Store Sync
- Security, audit, diagnostic and rate-limit data
We ask customers not to submit unnecessary special-category data, criminal-offence data, passwords, payment-card details or other highly sensitive information through general chat, support or AI fields.
4. Website and cookie data
When someone visits our website, we may collect technical information through server logs, cookies and similar technologies. This can include pages viewed, referral source, session activity, approximate location, device and browser information, and cookie choices.
We use essential cookies to operate and secure the website. Analytics, advertising or other non-essential cookies are used only in accordance with the choices presented through our cookie controls and applicable law.
Further information is provided in our Cookie Policy.
5. Account, enquiry and support data
When someone requests a demo, starts a trial, creates an account, buys a Service or asks for support, we may process:
- Contact and business details
- Website and organisation information
- Requested Service and commercial requirements
- Account, plan and installation details
- Support messages, attachments and diagnostic information
- Records of communications and outcomes
We use this information to respond, supply the Service, manage the relationship, keep records and protect account security.
6. AI, voice, chat and messaging data
Our conversational, booking, messaging and review Services may process:
- Questions and messages submitted by an end user
- Voice recordings or transcriptions where enabled
- AI-generated replies
- Contact, enquiry and booking details
- Conversation timestamps and history
- Routing, workflow and follow-up information
- Consent, opt-in and opt-out records
- Delivery status and messaging logs
The exact information depends on the customer’s configuration. Customers must inform their end users about relevant recording, transcription, AI and communication activity.
7. Billing and subscription data
We may process:
- Customer and billing contact details
- Plan, trial and subscription status
- Invoice, receipt and payment references
- Payment-method status
- Usage events and allowances
- Credits, metered activity and wallet-charge results
- Failed-payment and account-restriction information
Payment-card data is handled by the relevant payment or Marketplace billing provider. We do not store full payment-card numbers on our own website or application systems.
8. Store Sync data
Store Sync may process authorised WooCommerce and HighLevel information, including:
- Store URL, connection details and currency
- Product names, descriptions, images, categories and URLs
- Product and variation identifiers, SKUs, attributes and metadata
- Prices, stock quantities and stock status
- Upsell and cross-sell relationships
- Cart and checkout-link information
- HighLevel location, contact, tag, custom-field and setup information
- WooCommerce order number, status, total, currency and date paid
- Order line items, quantities, product names and totals
- Billing name, email address and telephone number for CRM matching
- Payment method name and coupon codes
- Back-in-stock registrations
- Withdrawal or cancellation-request information
- Workflow, webhook, MCP and API activity
- Usage, credit, billing, audit, rate-limit and security records
Store Sync does not intentionally collect or store customer card numbers, card security codes or payment-account passwords.
The Store Sync Privacy Notice explains this processing in more detail.
9. How we obtain personal data
We may receive personal data:
- Directly from the individual
- From a customer using our Services
- From an authorised HighLevel, WooCommerce or other integration
- From cookies, logs and service activity
- From payment, communications and infrastructure providers
- From public business sources where lawful
Customers must have authority to connect third-party systems and instruct us to process data from them.
10. How we use personal data
We may use personal data to:
- Provide, configure, maintain and support the Services
- Respond to enquiries and demonstrate our products
- Create and administer accounts
- Deliver voice, chat, messaging, review and booking functions
- Operate authorised integrations, workflows, agents and APIs
- Synchronise and retrieve authorised store information
- Build carts or checkout links and support product discovery
- Process subscriptions, credits and usage billing
- Monitor performance and investigate faults
- Secure accounts, prevent abuse and detect fraud
- Maintain audit, accounting and legal records
- Improve reliability, accessibility and customer experience
- Send service notices and lawful marketing communications
- Establish, exercise or defend legal claims
- Comply with legal and regulatory obligations
We do not sell personal data.
11. Lawful bases
Where we act as controller, we rely on one or more of:
- Contract: to provide a requested Service, administer an account, process billing and respond to contractual support requests
- Legitimate interests: to operate and improve our business, secure systems, prevent abuse, maintain records and communicate with business customers, where those interests are not overridden by individual rights
- Consent: for non-essential cookies and marketing or communications where consent is required
- Legal obligation: for tax, accounting, regulatory and lawful-disclosure requirements
- Legal claims: where processing is necessary to establish, exercise or defend a legal claim
Where we act as processor, the customer determines the lawful basis for its personal data. We process that data under the customer’s documented instructions and the applicable Data Processing Agreement.
12. AI processing and automated decisions
We may use AI providers to process prompts, messages, transcriptions and relevant context needed to produce a response or support a workflow.
We aim to limit information supplied to AI services to what is needed for the configured purpose. The customer controls the instructions and business use of output.
Our Services are not intended to make solely automated decisions that produce legal or similarly significant effects about individuals without appropriate customer review and safeguards. Customers must assess their own configurations and provide human intervention where required.
13. Who receives personal data
Personal data may be disclosed to:
- The customer that configured the relevant Service
- Authorised users and administrators
- HighLevel, WooCommerce and other integrations selected by the customer
- Communications, telephony and email providers
- AI, transcription and language-processing providers
- Hosting, database, security and monitoring providers
- Payment and Marketplace billing providers
- Analytics providers where permitted by cookie choices
- Professional advisers, insurers, auditors and potential business purchasers under confidentiality obligations
- Courts, regulators, law enforcement and public authorities where required by law
We do not share SMS consent or telephone numbers with third parties for their independent marketing.
14. Subprocessors and service providers
We use carefully selected providers to supply infrastructure and specialist functions. Depending on the Service, these can include:
- HighLevel and LeadConnector for CRM, Marketplace, workflow and communications functions
- WooCommerce and the customer’s WordPress hosting environment for Store Sync
- Supabase for Store Sync database and server-side application infrastructure
- Lovable for Store Sync frontend application hosting and development services
- Twilio or other authorised communications providers
- Payment and Marketplace billing providers
- AI, transcription and language-processing providers
- Website hosting, security, analytics, email and support providers
The current Data Processing Agreement and relevant product notice provide further subprocessor information. Providers must be subject to appropriate confidentiality, security and data-protection obligations.
15. International transfers
Some providers may process personal data outside the United Kingdom.
Where UK data-protection law requires a transfer safeguard, we use an appropriate mechanism, which may include:
- UK adequacy regulations
- The UK International Data Transfer Agreement
- The UK Addendum to the EU Standard Contractual Clauses
- Another lawful transfer mechanism
We also consider relevant technical, contractual and organisational protections.
16. Data retention
We keep personal data only for as long as required for the relevant purpose, contract, legal obligation or claim.
Typical periods include:
| Record | Typical retention |
|---|---|
| Prospective-customer enquiries | While the enquiry is active and for a reasonable follow-up and record period |
| Active account and configuration data | For the customer relationship |
| Billing, invoice and tax records | Normally at least 6 years after the relevant financial period |
| Support and contractual records | For the relationship and applicable limitation period |
| Voice, chat, SMS and workflow data | According to the customer configuration, contract and operational need |
| Security and technical logs | A limited period, unless needed for an active investigation or legal claim |
| Store Sync operational records | The periods stated in the Store Sync Privacy Notice |
Data may remain in protected backups until the applicable backup cycle expires. Where deletion is requested or a processor service ends, data may be placed beyond ordinary use before final backup deletion.
16A. Managed account closure and transfer
Where we administer a HighLevel account for a Customer, cancellation of our Service does not necessarily cause immediate deletion of the account or the personal data stored within it.
We normally provide a 30-day offboarding period after the Service ends. During this period, the account may be paused or restricted while the Customer requests:
- An available export of its personal data
- Transfer of the account to another HighLevel agency
- Transfer to an agency account controlled by the Customer
- Deletion of the account and its personal data
Where the account is transferred, personal data within the account will become accessible to the receiving agency or account administrator authorised by the Customer. The Customer is responsible for ensuring that the recipient is authorised and has an appropriate lawful basis for the continued processing.
If no transfer, export or earlier deletion instruction is received during the offboarding period, we may delete the HighLevel account and the personal data held within it.
Deletion from the live account may not immediately remove information from protected backups, security records, billing records or other information that we must retain for legal, accounting or claims purposes. Information retained in backups will remain protected and will be deleted or overwritten through the applicable backup cycle.
Store Sync information is handled separately in accordance with the Store Sync Privacy Notice and Store Sync Data Processing Agreement.
17. Security
We use technical and organisational measures appropriate to the processing risk. These can include:
- Access controls and authentication
- Encryption in transit and, where appropriate, at rest
- Tenant and account separation
- Credential and secret management
- Logging, monitoring and rate limits
- Backup and recovery measures
- Supplier due diligence and contracts
- Security testing and incident response
- Data minimisation and log redaction
No internet service is completely secure. Customers must also protect their accounts, devices, credentials and connected platforms.
18. Marketing and electronic communications
We may send service messages needed to administer an account, deliver a requested Service, maintain security or respond to support.
We send marketing by email, SMS or other electronic channels only where permitted by law. Recipients can use the unsubscribe method provided or contact us. SMS recipients may reply STOP where supported.
Opting out of marketing does not prevent necessary service or security communications.
19. Your rights
Depending on the circumstances, individuals may have the right to:
- Access their personal data
- Correct inaccurate or incomplete data
- Request erasure
- Restrict processing
- Object to processing based on legitimate interests or direct marketing
- Receive portable data
- Withdraw consent at any time where consent is the basis
- Request human review of certain automated decisions
- Complain to the Information Commissioner’s Office
Where we process data for a customer, the request should normally be made to that customer as controller. We will assist the customer as required by our Data Processing Agreement.
We may request information needed to verify identity and authority. Rights can be subject to legal limitations and exemptions.
20. Children
Our Services are intended for business customers and are not directed at children. Customers must not knowingly configure the Services to collect children’s data without an appropriate lawful basis, notice and safeguards.
21. Third-party websites and platforms
Links and integrations may lead to services controlled by other organisations. Their privacy notices and practices apply to their processing. We are not responsible for their independent use of personal data.
22. Changes to this policy
We review this Privacy Policy regularly and may update it when our Services, providers or legal obligations change. The current version will show the effective date. We will take reasonable steps to notify customers of material changes where appropriate.
23. Complaints and contact
For questions, requests or complaints:
JD Web Services Ltd trading as The Voice Concierge
104 High Street, Mold, Flintshire, CH7 1BH
Email: [email protected]
You may also complain to the Information Commissioner’s Office through https://ico.org.uk/make-a-complaint/.