Privacy Policy

Voicommerce ("Voicommerce", "we", "our", or "us") provides an AI-powered chat assistant widget for online merchants, SaaS platforms, educational institutions, and service providers. This Privacy Notice explains how Voicommerce collects, uses, discloses, and safeguards personal data when you use our website, our merchant dashboard, or the embedded assistant widget.

This Notice applies to both direct customers (merchants and site owners) and end-users of merchant websites (shoppers and visitors interacting with the assistant). It should be read together with our Terms of Service, Refund Policy, and GDPR statement.

Voicommerce is the data controller for personal data collected about our merchant account holders (registration data, billing contact details, support correspondence, and product-usage telemetry).

When a merchant embeds the Voicommerce widget on their own website, the merchant is the controller of their visitors' personal data and Voicommerce acts as a data processor on the merchant's instructions. See our GDPR page for the full controller/processor split.

A. From merchants and account holders

• Account credentials (name, email address, hashed password).
• Business metadata (store URL, platform type, industry, region for localised pricing).
• Billing contact details processed on our behalf by Paddle (see Section 6).
• Uploaded knowledge assets (CSVs, PDFs, policy documents you provide to train your assistant).
• Product-usage telemetry (feature use, error diagnostics, number of conversations, IP address, device and browser identifiers).
• Support correspondence you send us (email content, attachments, chat transcripts with our team).

B. From end-users of merchant sites

• Conversation transcripts exchanged with the assistant.
• Cart, page and session context so the assistant remains context-aware as the visitor browses.
• Order and delivery data retrieved from the merchant's store when the visitor requests order status.

We only process personal data for defined purposes and on a lawful basis:

• Providing the service (creating accounts, delivering the widget, answering shopper questions) — legal basis: performance of a contract.
• Billing and financial record-keeping — legal basis: performance of a contract and legal obligation. Payments and invoicing are handled by Paddle as Merchant of Record.
• Security, fraud prevention and abuse detection — legal basis: legitimate interest in keeping the service safe.
• Product improvement and internal analytics using aggregated, non-identifying signals — legal basis: legitimate interest.
• Customer support and responding to your enquiries — legal basis: legitimate interest / performance of a contract.
• Marketing communications where required — legal basis: consent, which you can withdraw at any time.
• Compliance with law — where we are required to retain or disclose data by applicable law.

Voicommerce operates on a strict data-isolation model. Conversations and knowledge from one merchant are never used to train other merchants' assistants or shared with third parties for training.

• Per-tenant isolation: conversations, uploaded documents, and scanned website content are scoped to your merchant account.
• No cross-customer model training: we do not use your customers' conversations to train our global AI models or those of our sub-processors.
• Grounded answers: the assistant is instructed to respond only from content it can cite (your uploaded documents and scanned website pages). When it cannot answer, it flags a gap for your team instead of guessing.

Voicommerce does not sell, rent, or trade personal data. We share limited data with carefully selected service providers acting on our documented instructions under data-processing agreements:

• Paddle.com Market Ltd. — our Merchant of Record. Paddle handles payments, subscription billing, tax compliance (VAT, GST, sales tax), and invoicing. Card and bank details are collected and stored by Paddle, not by Voicommerce. See Paddle's privacy notice.
• Cloud hosting and database providers for storing account and conversation data in secure, access-controlled environments.
• AI providers for generating responses. Content sent to these providers is used only to serve the current request.
• Analytics providers (e.g. Google Analytics) loaded only when the user has consented via our cookie banner.
• Support and communications tools used to reply to your enquiries.
• Professional advisers (legal, accounting) where necessary to run the business.
• Authorities where disclosure is required by law or to protect our rights.

Some of our sub-processors operate outside the European Economic Area and the United Kingdom. Where personal data is transferred outside these regions, we rely on lawful transfer mechanisms — typically the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum, together with additional technical and organisational safeguards.

A list of current sub-processors and the applicable safeguards is available on request via support@voicommerce.com.

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the site is used. You can manage cookie preferences at any time from the cookie icon in the bottom-left corner of the page.

We retain personal data only as long as necessary for the purposes described in Section 4:

• Account data is retained while your account is active and for up to 90 days after account closure to permit reactivation and dispute resolution.
• Conversation transcripts and uploaded documents can be exported and deleted at any time from your Voicommerce dashboard. After deletion, records are purged from active systems within 30 days and from backups within the standard backup rotation.
• Billing and tax records handled by Paddle are retained by Paddle for the periods required by applicable tax and accounting law.
• Security and audit logs are retained for up to 12 months.

Depending on where you live, you may have rights under the GDPR, the UK GDPR, the CCPA/CPRA, or other applicable privacy laws, including the right to:

• Access the personal data we hold about you and receive a copy in a portable format.
• Correct inaccurate personal data.
• Request deletion of your personal data ("right to be forgotten").
• Restrict or object to certain processing.
• Withdraw consent where processing is based on consent.
• Opt out of the sale or sharing of personal information (Voicommerce does not sell personal information).
• Lodge a complaint with your local supervisory authority.

To exercise these rights, contact support@voicommerce.com. We will respond within one month of receiving a verifiable request.

Voicommerce implements appropriate technical and organisational measures to protect personal data, including TLS in transit, encryption at rest for the primary database, least-privilege access controls, per-tenant data isolation, and regular review of security practices. No system is 100% secure, but we take our obligations seriously and respond promptly to any incident that materially affects your data.

Voicommerce is not directed to children under 16 and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Notice from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page and, where appropriate, by notifying active customers by email.

For privacy questions, data-subject requests, or to request a Data Processing Agreement, contact support@voicommerce.com.