Privacy Policy

Nuvox is a service operated by Andrii Mysheniuk, a sole trader based in the United Kingdom. Our contact address is 1 Ariel Way, London, W127SL.

For questions about this policy or about personal data, contact andriy.mysheniuk@gmail.com.

TODO(founder): most UK businesses processing personal data electronically must register with the ICO and pay the data protection fee. Complete the ICO self-assessment, then set ICO_REGISTRATION in config.ts — or confirm in writing that an exemption applies.

This distinction decides who is responsible for what, so it is worth being precise about.

• For business account data we are the controller. When you sign up, we decide what we collect about you and your staff, and we are accountable for it.
• For conversation data we are the processor. When your customer calls or messages your agent, that person’s data belongs to your business. You are the controller; we process it on your instructions. If one of your customers asks us to delete their data, we will direct them to you and support you in responding.

From businesses using Nuvox:

• Account details — name, email address, and password (stored hashed, never in plain text).
• Business information you enter so the agent can answer accurately — trading name, address, opening hours, services, prices, FAQs.
• Documents and web pages you add to the knowledge base, and the search indexes built from them.
• Usage records — call minutes, message counts, and cost calculations for your billing and reporting.

From people who contact a business through Nuvox:

• The phone number or WhatsApp number the contact came from, or an anonymous visitor identifier for web chat.
• A written transcript of the conversation, including anything the caller chose to say or type.
• Timestamps, the channel used, and whether a human took over.

We do not store call audio. Speech is converted to text as the call happens, and the audio is not written to our systems or retained by us afterwards.

• To provide the service — answering calls and messages, booking appointments, capturing leads. Lawful basis: performance of a contract with the business; for the caller’s data, the business’s own lawful basis as controller.
• To keep the service working and secure — diagnosing faults, preventing abuse, monitoring reliability. Lawful basis: legitimate interests.
• To meet legal obligations — accounting and record-keeping where the law requires it. Lawful basis: legal obligation.

We do not sell personal data, we do not share it for advertising, and we do not use your conversations or documents to train any general-purpose AI model.

Our database, file storage, and application servers are hosted in London, United Kingdom (Supabase eu-west-2 and Fly.io lhr).

Some of the specialist providers we rely on process data outside the UK — in particular the speech and language-model providers listed below, which operate in the United States. Those transfers are made under the UK International Data Transfer Addendum or equivalent safeguards in each provider’s terms.

We use the following sub-processors. Each one handles data only to deliver the function described.

If you connect your Google account to Nuvox, we access a small, specific slice of your Google data — only what the connected feature needs, only for your own workspace, and only after you grant permission through Google’s own consent screen.

This data is handled the same way as everything else in this policy, specifically:

• It is used only to provide the calendar-booking feature you turned on — never for advertising, never for profiling, and never to train any AI model.
• It is never sold, and never shared with anyone except Google itself (to operate the connection) and the sub-processors listed above who host and run the service.
• No one at Nuvox reads your calendar by hand. The data is used only by the automated booking feature — the same limited-use terms that apply to every other Google Workspace API we use.
• Nuvox reads and writes only the one calendar you select, and only the events involved in your bookings. It does not read your other calendars.
• You can disconnect your Google account at any time from your workspace settings, which revokes Nuvox’s access immediately. You can also revoke access directly at myaccount.google.com/permissions.

Our use of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.

• Conversations and transcripts — 12 months from the end of the conversation, then deleted.
• Business and knowledge-base content — for as long as the account is open. Deleting an item removes it and its search indexes.
• Account records — for as long as the account is open, then removed within 90 days of closure, apart from records we must keep for accounting purposes.

Under UK GDPR you may request access to your personal data, correction of it, deletion of it, restriction of how it is used, a portable copy, or object to processing based on legitimate interests. Contact andriy.mysheniuk@gmail.com and we will respond within one month.

If you contacted a business that uses Nuvox and want your data removed, ask that business directly — they control it. Tell us and we will help them action it.

You can also complain to the Information Commissioner’s Office at ico.org.uk. We would rather you raised it with us first.

Data is encrypted in transit and at rest by our hosting providers. Access to production data is limited to those who need it to run the service. Each business’s data is isolated at the database level, so one customer cannot read another’s. Passwords are stored as salted hashes and are never visible to us.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify you and the ICO as the law requires.

We use only what is necessary to run the service: a session cookie that keeps you signed in, and a local identifier that lets a web-chat conversation continue if the page is reloaded. We do not use advertising or third-party analytics cookies, so there is no consent banner to click through.

If we change this policy we will update the effective date above, and tell account holders by email where the change is significant. This policy is governed by the law of England and Wales.

Questions: andriy.mysheniuk@gmail.com.