Privacy Policy

1. Who We Are

Voxa MTD Limited ("Voxa", "we") runs two products. VoxaMTD is Making Tax Digital software for UK sole traders and landlords; for VoxaMTD accounts we are the data controller for your personal information. Voxa Estate is software for letting agencies; for the tenants, landlords and contractors an agency deals with, the agency is the controller and we are its processor (see section 11).

• Contact: hello@voxamtd.com
• Registered address: 4 Allcroft Road, 4 Hillside Court, Reading RG1 5DJ, United Kingdom
• ICO registration: Voxa MTD Limited is registered with the Information Commissioner's Office, registration ZC113197.
• Company registration: 16984959

2. Information We Collect

We collect account information (name, email, phone, business address), financial data via Open Banking (bank transactions, account balances, account holder details), tax information (income and expense categorisation, HMRC submissions), technical data (IP address, browser type, device information, screen resolution, timezone (required by HMRC for fraud prevention)) and usage data (features used, pages visited, login times).

3. Open Banking Authorization

We use Finexer (FCA FRN: 925695) to connect to your bank account with your explicit consent. When you connect your bank you authorize us to access your transaction history, account balances and account holder details. Access lasts 90 days, after which you must re-authorize. We access transaction information daily to keep your records up to date. You can disconnect your bank at any time through your account settings. We never see or store your online banking password. This remains with your bank. Finexer is authorised and regulated by the FCA (FRN 925695).

4. Legal Basis for Processing

We process your data on the basis of contract necessity (managing your account, HMRC submissions), explicit consent (accessing bank data, marketing emails), and legal obligation (HMRC submissions and fraud prevention headers required by UK tax law).

5. HMRC Data Transmission

As Making Tax Digital software, we submit your tax information to HMRC on your behalf. This includes quarterly income and expense updates, annual Self Assessment data, device and connection information (fraud prevention headers) as required by UK tax law, and VAT information if applicable. You authorize these submissions when you use VoxaMTD to submit to HMRC.

6. Who We Share Your Data With

We share bank authorization details with Finexer (FCA FRN: 925695) to provide open banking access; tax data and fraud prevention headers with HMRC under legal obligation for MTD compliance; and all data with Supabase, our infrastructure provider. We do not sell your data to third parties.

7. Data Retention

Your account and records are kept while you have an account, to provide the service. Tax records and MTD submissions are kept for 6 years after the end of the tax year: you must keep tax records until 5 years after the 31 January filing deadline (Taxes Management Act 1970 s.12B), and we keep them so you can. Bank transaction data is kept while you have an account, then as tax records if used in a return. After you cancel, your data is kept for 12 months so you can come back, then deleted; automatic deletion is not switched on yet, and until it is, we delete on request. Database backups are kept for 7 days (one backup a day), then overwritten. HMRC connection logs (the device and connection details sent with each submission) are kept for 6 years with the submission, our choice, so we can show what was sent to HMRC. We are switching on automatic deletion at the end of these periods. Until it runs, we delete data when you ask. Checked against our systems on 2 October 2026.

8. Your Rights Under UK GDPR

You have the right of access, rectification, erasure (subject to legal obligations like tax record retention), restriction of processing, data portability, the right to object to processing based on legitimate interests, the right to withdraw consent at any time, and the right to complain to the ICO. To exercise any of these rights, email hello@voxamtd.com. We will respond within 1 month.

If your data is in Voxa Estate because a letting agency uses it, see section 11 for how to use these rights through the agency or with us, and section 12 to ask for deletion.

9. Data Security

We protect your data with encryption in transit (all connections use HTTPS/TLS), encryption at rest (our database host, Supabase, encrypts stored data and backups with AES-256), secure authentication with optional multi-factor authentication, and storage of our database and files in the EU (Paris). Finexer, our open banking provider, is authorised and regulated by the FCA (FRN 925695).

10. International Transfers

Our main database, file storage and sign-in service are hosted by Supabase in the European Union (Paris, France). Some of our service providers process personal data in the United States, including for email, text and WhatsApp messages, voice calls, payments and our AI assistant. When personal data leaves the UK, we rely on the UK's adequacy regulations for the EEA. For other countries we rely on the safeguard each provider offers, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework. Ask us for the list of these providers and the safeguard each one relies on.

11. Voxa Estate: data we handle for letting agencies

Voxa Estate is software that Voxa MTD Limited provides to letting agencies and other property managers ("the agency"). It handles tenants' repair reports, messages with landlords and contractors, safety certificate dates and the record of each job. This section explains what happens to the personal data of the tenants, landlords, contractors and agency staff whose details are in it. Sections 1 to 10 above are about VoxaMTD accounts; where they differ, this section applies to Voxa Estate.

11.1 Who is in charge of your data

For the tenants, landlords and contractors an agency deals with, the agency is the controller: it decides why and how the data is used. Voxa is the agency's processor: we handle the data only on the agency's written instructions, under a data processing agreement that each agency signs before we handle any tenant data.

Voxa is the controller, on its own account, for the agency's account, billing and contact records about the agency and its staff; the security and operational logs we keep to run and protect the service; and our own marketing to agencies.

Tenants can read the shorter notice written for them at voxamtd.com/privacy/tenants. Contractors contacted about a job can read voxaestate.com/privacy/trades.

11.2 Whose data, and what we handle

• Tenants and their household: Name, phone number, email address, home address and tenancy details; repair reports (message text, photos, videos, voice notes and the text of voice notes); appointments; and the urgency, trade and hazard type suggested for each repair.
• Landlords: Name and contact details, the properties they own, the spending limits they set, repair approvals, quotes, costs and the reports sent to them.
• Contractors: Business name, contact details, trade, company number, quotes, invoices, certificates, messages, and the written record of phone calls about a job.
• Agency staff: Name, work email address, role, and what they do in the service (kept in the agency's audit log).
• Health and other sensitive details: We do not ask for them. Messages, photos and voice notes can contain them, usually when a tenant explains how a repair affects someone at home. They are used only to deal with the repair. The agency is responsible for the legal condition that allows this.

11.3 WhatsApp, text messages, email and phone calls

• WhatsApp: Tenants report repairs to the agency's WhatsApp number. Messages, photos, videos and voice notes reach us through Twilio, which connects us to Meta's WhatsApp Business Platform. We receive the sender's phone number, the message and its media, and whether our replies were delivered. We use them to log the repair, reply, spot danger quickly and keep the agency updated. Voice notes are turned into text by ElevenLabs so they can be read and sorted.
• Text messages (SMS): Some messages to and from tenants, landlords and contractors are sent as text messages through Twilio, for example about a repair, a quote or a visit.
• Email: Emails to contractors, landlords and agency staff (quote requests, reports and alerts) are sent through Resend. Repair reports emailed to an agency's Voxa repairs address are received through Resend and kept with the job.
• Phone calls: Calls to contractors about a job, and calls to an agency's repairs line where it has one, can be made or answered by an automated (AI) voice. The call audio passes through Fly.io (London) to OpenAI, which runs the voice; lines not yet moved to OpenAI use ElevenLabs. Voxa keeps a written record of what was said, not sound recordings. The voice providers may keep call data for a short time to check for misuse.
• Sorting repair reports: Anthropic's AI reads repair messages, photos and the conversation so far to suggest how urgent a repair is and what kind of contractor is needed, and to draft replies. It works within limits the agency sets, and the agency can see what it does and step in. A separate keyword check looks for danger words such as gas or fire and alerts the agency at once.
• Never sold: We never sell this data and we do not use it for advertising.

11.4 Lawful basis

The agency, as controller, decides and is responsible for the lawful basis for its data. These are the bases we expect agencies to rely on, and the ones Voxa relies on for the data it controls.

• Tenants and their household: The legitimate interests of the agency and the landlord in dealing with repairs and keeping the home safe (UK GDPR Article 6(1)(f)); the tenancy agreement, where the agency or landlord is a party to it (Article 6(1)(b)); and the landlord's legal duties to repair the home and keep it safe (Article 6(1)(c)).
• Landlords: The agency's management agreement with the landlord (Article 6(1)(b)).
• Contractors: The legitimate interests of the agency and the landlord in getting repairs done (Article 6(1)(f)), and the contract for the job once a contractor is instructed (Article 6(1)(b)).
• Agency staff: Inside the agency's organisation, the agency's legitimate interests in running its business. For Voxa's own records of the agency's account and our security logs, Voxa's contract with the agency and our legitimate interest in running and protecting the service.
• Health details in messages: A condition under UK GDPR Article 9, which the agency chooses and is responsible for.

11.5 Companies that help run Voxa Estate

• Twilio Inc. (United States): Carries WhatsApp and text messages, their media and phone numbers, and connects phone calls. Twilio's EU region does not support WhatsApp, so this runs in the United States.
• Meta (WhatsApp), reached through Twilio: Carries WhatsApp messages.
• Supabase (EU: Paris, France): Stores the data: database, files and back-end functions.
• Anthropic (United States): AI that reads and sorts repair reports and drafts replies.
• ElevenLabs (United States): Turns WhatsApp voice notes into text, and runs the AI voice on phone lines not yet moved to OpenAI (being replaced for calls, October 2026).
• OpenAI (United States): Runs the AI voice on phone calls.
• Fly.io (London; a US company): Carries call audio between the phone network and OpenAI. We do not store the audio there.
• Resend (sends from Ireland; logs in the United States): Sends and receives emails.
• Google Maps Platform: Helps find local contractors, using only the trade and the area.

11.6 Sending data outside the UK

Our main database and files are in the EU (Paris). The UK's adequacy regulations cover the EEA. Twilio, Anthropic, ElevenLabs, OpenAI and Resend process data in the United States. Each names a safeguard in its own terms: Twilio relies on the UK Extension to the EU–US Data Privacy Framework where it applies, its Binding Corporate Rules, and the EU Standard Contractual Clauses with the UK International Data Transfer Agreement as a fallback; Anthropic, ElevenLabs and Resend rely on the EU Standard Contractual Clauses with the UK Addendum. For OpenAI and Fly.io we are still confirming the safeguard their terms name. These are what each provider states about itself. Ask us at hello@voxamtd.com for the details.

11.7 How long we keep it

The agency decides how long its data is kept. Unless it tells us otherwise in writing, these are the standard periods.

• Repair records: Reports, messages, photos, the AI's suggestion, quotes, approvals, appointments and invoices: 6 years after the job closes, or after the tenancy ends if that is later.
• WhatsApp photos and voice notes: 6 years. Media not attached to any job will be kept for 12 months once we can tell it apart.
• Messages sent to tenants, landlords and contractors: The wording for 6 years, then only a record that the message was sent (kept 6 years).
• Phone calls: Written records of calls: 90 days. Call records (number, outcome, times): 2 years.
• Contact details: While the tenancy or working relationship lasts, then 6 years. Contractors contacted but never used: 2 years.
• Uploaded spreadsheets: 30 days after the import finishes.
• Database backups: 7 days, then overwritten.
• When an agency leaves: We return or delete its data within 30 days of its instruction, or within 60 days of the end of the agreement if it gives none, and confirm deletion in writing.

Automatic deletion at the end of these periods is not switched on yet. Until it is, data is kept for longer, not deleted early, and we delete data when asked.

11.8 Your rights, and how to use them

You have the rights listed in section 8: to see a copy of your data, correct it, have it deleted, limit or object to how it is used, move it, and complain to the ICO.

• Through the agency: For data an agency holds in Voxa Estate, ask the agency. It is the controller and must reply within one month.
• Directly to Voxa: Or email hello@voxamtd.com. We pass the request to the agency within 5 working days and help it answer. For data Voxa controls itself (see "Who is in charge of your data"), we answer you directly within one month.
• Stopping WhatsApp messages: Reply STOP. Reply START to turn them back on.
• Deletion: See section 12 and our data deletion page.

11.9 How we protect it

Data is encrypted in transit (HTTPS/TLS), and our database host encrypts it at rest (AES-256). Each agency's records are kept apart by row-level security, staff roles limit what each person can do, and an audit log records what happens in each agency's organisation. Connection tokens for other systems are kept in a secrets vault. Two-factor sign-in is available to agency staff; it is not yet required. We do not hold Cyber Essentials, ISO 27001 or SOC 2 certification yet.

12. Deleting your data

You can ask us to delete your data at any time. Email hello@voxamtd.com and tell us the email address or phone number your data is held under. If a letting agency uses Voxa Estate to deal with you, you can also ask the agency. VoxaMTD account holders can delete their account in the app: Settings, then Delete Account.

We reply within one month. Deletion is done by a person, on request; it is not automatic yet. Some records may have to be kept, for example records an agency needs to show what was reported and done about a repair, or tax records; we tell you what is kept and why.

Our data deletion page explains who to ask, what we delete, what may have to be kept, and how long it takes.

13. Cookies

We use strictly necessary cookies to keep you signed in and remember your cookie choice. Analytics and advertising cookies (Google Analytics, Google Ads, Meta Pixel) load only if you accept. See our Cookie Policy for the full list and how to change your choice.

14. Complaints

If you are unhappy with how we use your data, tell us at hello@voxamtd.com. We acknowledge complaints within 30 days.

You also have the right to complain to the UK data protection regulator: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Phone: 0303 123 1113. Website: ico.org.uk.

15. Changes to This Policy

We may update this privacy policy from time to time. We'll notify active users of significant changes via email to the address associated with your account. Continued use of VoxaMTD or Voxa Estate after changes take effect constitutes acceptance of the updated policy.