Privacy Policy

This notice explains how Ventriqa uses personal data. We have tried to write it in plain English. If anything is unclear, email privacy@ventriqa.com.

1. Who we are

Ventriqa is a trading name of [Company legal name], a company registered in England and Wales (company number [Company number]). Our registered office is at [Registered address]. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO registration number].

Ventriqa is an online platform that helps small businesses with their marketing and day-to-day customer contact: marketing plans, social media content, reviews, AI call answering, text and WhatsApp messaging, website chat, AI agents that can take bookings, and lead finding.

2. Two different roles

Depending on whose data it is, we play one of two roles under UK data protection law.

• We are the controller for data about the people who use Ventriqa itself: account holders and their team members, people who visit our website, sign up for our free tools, or contact us. This notice mainly covers that data.
• We are a processor for data about a business's own customers — for example callers to a business's phone line, visitors who chat with a business's website chatbot, people who leave a review, receive a text or book an appointment. The business is the controller of that data and decides how it is used. We only process it on the business's instructions, under our Data Processing Addendum.

If you contacted a business that uses Ventriqa and want to know what it holds about you, please ask that business first — it is responsible for answering you. If you contact us instead, we will pass your request to the business and help it respond. See section 5 for what we process on a business's behalf.

3. What we collect about account holders and why

The table below covers data we control. "Lawful basis" is the legal reason UK GDPR lets us use it.

4. Visitors to our website and free tools

5. Data we process for businesses (as a processor)

When a business uses Ventriqa to deal with its own customers, we handle the following on its behalf. The business decides what to collect and why, and must tell its customers.

• Phone calls: caller phone number, what was said (transcript and summary), call recordings where the business has recording switched on, voicemails, and any details the caller gives such as name, address or reason for calling.
• Website chat and AI agents: the conversation, and any name, email address or phone number the visitor chooses to share.
• Text and WhatsApp messages: phone number, message content and opt-out status.
• Bookings: name, email address, phone number, the appointment and any notes.
• Reviews and QR codes: name, email address or phone number where given, feedback and reviews, marketing preferences, prize and loyalty-pass details, and technical details of QR code scans (IP address, browser and device type).
• Customer records: a business's customer list, enquiries and the history of contact with each customer. Ventriqa can link conversations from the same person across channels within one business's account, so the business sees one history. It never links people across different businesses.
• Lead finder: publicly listed business contact details (such as business name, phone, email address and website) found through our data supplier at the business's request.

We do not sell this data and do not use it for our own marketing. Each business's data is kept separate from every other business's data.

6. How we use AI

Many Ventriqa features use AI models from third-party providers (see our sub-processor list). When you use those features, the relevant text — for example your business details, a customer's message or a call transcript — is sent to the AI provider to produce a response.

• AI-written content is a suggestion. You should check it before you publish or send it.
• AI agents that talk to the public (chatbots, phone and message assistants) are limited to information the business has marked as suitable for customers. A business's private planning notes are kept out of those answers.
• [Confirm: under their API terms, our AI providers do not use data sent through the API to train their models.]

We do not make decisions about people based solely on automated processing that have legal or similarly significant effects on them. AI agents can do things like offer appointment times or pass a message on, but they do not decide, for example, whether someone gets credit, a job or a service on terms that affect their rights.

7. Who we share data with

We share personal data only as needed to run the service:

• Service providers (sub-processors) — hosting, AI, telephony, messaging, payments, email and error monitoring. The full list, with what each receives and where it is, is on our sub-processors page.
• Services you connect — for example Meta (Facebook, Instagram, WhatsApp) or Google Calendar, when you ask us to publish, message or book through them. Their own privacy terms apply to what they hold.
• Your partner or franchisor — if your account is managed by an agency, franchisor or white-label partner, that partner can see and manage your account. Every time they do, it is logged.
• Webhooks you set up — if you tell Ventriqa to send new leads to another system (for example a spreadsheet or automation tool), we send them there.
• Professional advisers and authorities — our lawyers, accountants and insurers where needed, and the police, regulators or courts where the law requires it.
• A buyer of our business — if we sell or merge the business, under the same protections.

We never sell personal data.

8. International transfers

Some of our service providers are based outside the UK, mainly in the United States and the European Economic Area. Where personal data goes to a country the UK has not found to have adequate protection, we rely, where applicable, on the UK Extension to the EU–US Data Privacy Framework for certified US providers, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more detail at privacy@ventriqa.com.

9. How long we keep data

We keep personal data only as long as we need it. Our automatic daily clean-up applies these rules:

If a business asks us to delete particular customer data sooner, we will do so. [Confirm the process — there is no self-serve delete for individual conversations or customer records yet.]

10. How we protect data

• Data is sent over encrypted connections (HTTPS).
• Passwords are stored as secure hashes, and access tokens for connected accounts, telephony credentials and two-factor secrets are encrypted in our database.
• Two-factor authentication is available to every user, and is required for our administrators and for partner administrators who can access client accounts.
• Each business's data is separated from every other business's data, including in our AI search index.
• Team roles limit who can see billing and export data. Staff and partner access to an account is logged.
• Incoming webhooks from our call providers are checked for a valid signature.
• We take nightly database backups.

No system is perfectly secure, but we work to keep risks low and will tell you and the ICO about a serious breach when the law requires.

11. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted in some circumstances;
• restrict or object to how we use it, including objecting to direct marketing at any time;
• data portability — receive data you gave us in a reusable format;
• withdraw consent where we rely on it, without affecting what we did before.

You can do a lot of this yourself:

• Edit your details on your Profile page.
• The account owner can download a ZIP of the business's data from the Profile page ("Download your organization's data").
• Delete your account from the Profile page. See data deletion for the steps.

For anything else, email privacy@ventriqa.com. We will reply within one month. We may need to check who you are first.

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113.

12. Cookies and similar technologies

We keep cookies to a minimum. We do not use advertising or analytics cookies on our website.

We also store a few preferences in your browser's local storage rather than in cookies — for example your chosen currency on the pricing page, light or dark theme, and which product tours you have seen. Website chat windows keep the current conversation in session storage, which is cleared when the browser tab is closed. These are not sent to us for tracking.

Some third parties may set their own cookies when you use features that load their services:

• Stripe on checkout and payment pages, for payment processing and fraud prevention.
• Meta when you connect a WhatsApp Business account through Meta's sign-up window.
• Our web fonts are loaded from Bunny Fonts, which receives your IP address to deliver them but does not set cookies [confirm].

13. Children

Ventriqa is a service for businesses and is not aimed at children. You must be 18 or over to open an account. We do not knowingly collect data about children for our own purposes. If you think a child has given us personal data, email privacy@ventriqa.com and we will delete it.

14. Changes to this notice

We will update this notice when what we do changes. We will show the date of the latest version at the top of this page, and tell account holders by email or in the app about significant changes.

15. Contact us

Email privacy@ventriqa.com, or write to [Company legal name], [Registered address]. [If a Data Protection Officer is appointed, add their contact details here.]