Policy of confidentiality
How VOCALIS AI collects, processes and protects your personal data — in accordance with GDPR and UK GDPR.
Last updated: May 11, 2026 · Data controller: VAULT 369 LTD (16952492)
Summary
1. Who are we?
Data controller: VAULT 369 LTD
Brand : VOCALIS AI
Registration: 16952492 (Companies House, UK)
Seat : 128 City Road, London EC1V 2NX, United Kingdom
Operational address: Chemin Saint-Hubert 2, 1950 Sion, Switzerland
Contact : contact@vocalis.pro
VOCALIS AI develops and markets artificial intelligence voice agents for businesses. As data controller, VAULT 369 LTD determines the purposes and means of processing personal data collected via the vocalis.pro site and associated services.
2. Data collected
2.1 Navigation data (visitors)
- IP address (automatically anonymized)
- Pages visited, session duration, traffic source
- Browser type, operating system, screen resolution
- Data collected via Google Analytics 4, only with your prior consent
2.2 Contact data (prospects)
- First and last name
- Professional email address
- Phone number
- Company name and industry
- Free message submitted via a contact or demo booking form
2.3 Contractual data (customers)
- Billing details (name, address, email)
- SIRET/SIREN number or foreign equivalent
- Banking information (IBAN for SEPA direct debit — stored with the payment provider)
- Contractual history and quote
2.4 Service usage data (active customers)
- Call logs (date, time, duration, calling/called number)
- Call transcripts (if feature enabled by customer)
- AI agent performance metrics (qualification rate, response time)
- Agent configuration data (scripts, knowledge bases)
2.5 Data we do NOT collect
- Special category data (health, ethnic origin, political opinions, etc.) — unless explicitly agreed and specifically necessary
- Personal data of the final contacts of the AI agent (this data is the responsibility of the client)
- Raw payment data (card numbers) — managed exclusively by our PCI-DSS certified partners
3. Purposes & legal bases
- Provision of the VOCALIS AI service — basis: execution of the contract (art. 6.1.b GDPR)
- Customer relationship management & billing — basis: execution of the contract + legal obligation (art. 6.1.b and 6.1.c)
- Response to contact requests & demos — basis: legitimate interest (art. 6.1.f)
- Improved service & security — basis: legitimate interest (art. 6.1.f)
- Audience measurement (analytics) — basis: consent (art. 6.1.a)
- Marketing communications & newsletter — basis: consent (art. 6.1.a) — with permanent opt-out available
- Accounting and tax preservation — basis: legal obligation (art. 6.1.c)
4. Shelf life
- Navigation data: 26 months (standard GA4 parameter)
- Contact data / prospects: 3 years from last active contact
- Contractual and billing data: 10 years (legal accounting obligation)
- Call logs: 12 months by default, configurable by the customer up to 36 months
- Call transcripts: duration chosen by the customer during configuration
- Cookie consent data: 13 months (CNIL compliance)
- AI Agent Knowledge Bases: contract duration + 3 months
At the end of these periods, the data is deleted or anonymized. You can request the early erasure of your data in the cases provided for by law (see section “Your rights”).
5. Data recipients
Your data may be shared with the following categories of third parties, strictly within the framework of the purposes set out:
- Host: Vercel Inc. (cloud infrastructure, CDN)
- AI infrastructure: suppliers of natural language processing models (under GDPR compliant DPA)
- Telephony: SIP/PSTN operators for call termination
- CRM / customer integrations: Salesforce, HubSpot, or other customer-configured CRMs
- Billing & payment: Stripe Inc. (PCI-DSS certified)
- Analytics: Google Analytics 4 (with consent)
- Support & communication: internal ticketing and email tools
We never sell your data to third parties. No sharing for third-party advertising purposes takes place.
6. Data transfers outside the EU/EEA
Some of our subcontractors are established outside the European Union (particularly in the United States). These transfers are supervised by:
- Standard Contractual Clauses (SCC) adopted by the European Commission (decision 2021/914/EU)
- UK International Data Transfer Agreements (IDTA) for transfers from the United Kingdom
- Transfer Impact Assessment carried out for each subcontractor outside the EEA
The list of subcontractors and associated guarantees is available on request at contact@vocalis.pro.
7. Your rights
In accordance with Regulation (EU) 2016/679 (GDPR) and the UK GDPR (for persons in the United Kingdom), you have the following rights:
- Right of access (art. 15) — obtain confirmation that data concerning you are processed, and have a copy.
- Right of rectification (art. 16) — have inaccurate data corrected or incomplete data completed.
- Right to erasure / right to be forgotten (art. 17) — request the deletion of your data in the cases provided for (data no longer necessary, withdrawal of consent, unlawful processing, etc.).
- Right to portability (art. 20) — receive your data in a structured, commonly used and machine-readable format (JSON or CSV).
- Right to object (art. 21) — object to processing based on legitimate interest, or to direct marketing.
- Right to limitation (art. 18) — temporarily restrict processing that is contested or awaiting verification.
- Right not to be subject to an automated decision (art. 22) — applicable if a decision affecting you is taken solely on the basis of automated processing.
How to exercise your rights
Send your request to contact@vocalis.pro specifying your identity and the nature of your request. We respond within a maximum of 30 days (deadline extendable to 3 months for complex requests, with prior information).
Complaint to a supervisory authority
If you believe that your rights are not respected, you can file a complaint with:
- CNIL (National Commission for Information Technology and Liberties) — France: cnil.fr
- ICO (Information Commissioner's Office) — United Kingdom: ico.org.uk
- Data protection authority of your country of residence
9. Data of minors
VOCALIS AI is an exclusively B2B service intended for adult professionals. We do not knowingly collect personal data from persons under 16 years of age. If you believe that a minor has provided us with data, contact us immediately at contact@vocalis.pro.
10. Changes to this policy
We may update this policy at any time to reflect changes in our practices, legal obligations or services. The current version is always the one displayed on this page, with the last update date in the header.
In the event of a substantial change affecting the rights of data subjects, we will inform active customers by email at least 14 days before the new version comes into force.
11. Contact & exercise of rights
Data controller / DPO: VAULT 369 LTD
Email: contact@vocalis.pro
Address : 128 City Road, London EC1V 2NX, United Kingdom
Response time: 30 days maximum
For any request relating to your personal data (access, rectification, erasure, portability, opposition), send an e-mail to the address above, attaching an identity document if necessary to verify your identity.
Questions about your data?
Our team responds within 30 days. No sharing, no selling of data. Your privacy is our commitment.
Write to contact@vocalis.pro