Privacy Policy

Vokl is an AI voice booking service for taxi and private-hire operators. It answers an operator's booking line with an automated voice agent that understands callers, quotes fares, and creates bookings. This policy explains what personal data we handle, why, and the choices and rights you have.

Vokl also provides an order-confirmation app for Shopify merchants that sends order-confirmation messages to their customers over WhatsApp and records the customer's confirm or cancel response on the order.

Vokl is operated by Cabree LTD, a company registered in England and Wales ("Vokl", "we", "us"). It applies to the Vokl website, the operator dashboard, the AI voice agent, and the Shopify order-confirmation app (together, the "Service").

1. Controllers and processors

Vokl handles personal data in two distinct roles:

• As a controller — for the accounts of the taxi operators who subscribe to Vokl (their staff's names, emails, roles, and login details), and for our own website and security data.
• As a processor — for the personal data of callers and passengers that we process to run an operator's booking line (names, phone numbers, pickup and drop-off addresses, call audio and transcripts, and booking details). Here the taxi operator is the controller and decides how that data is used; we act on their instructions.
• As a processor — for the personal data of a Shopify merchant's customers that we process to run the merchant's order-confirmation service (customer name, phone number, and order details). Here the Shopify merchant is the controller; we act on their instructions.

If you are a passenger and want to exercise your data rights, please contact the taxi operator you called. We will help them respond, or you can contact us and we will forward your request.

2. Information we collect

Operator account data

• Name, work email, company / trading name, and role.
• Authentication data (passwords are stored only as salted hashes by our auth provider).
• Configuration you enter, including AI greeting, voice settings, and service area.

Caller and booking data (processed for operators)

• The caller's name and phone number where provided.
• Pickup and drop-off addresses, postcodes, and the coordinates we resolve for them.
• Call audio, processed in real time so the agent can understand speech, and the resulting transcript of the conversation.
• Booking details — reference, ride type, fare estimate, status, and timestamps.

Shopify order data (processed for merchants)

• The customer's name and phone number from the order.
• Basic order details, such as the order number, items, and total.
• The customer's confirm or cancel response, recorded on the Shopify order.

Technical data

• IP address, device and browser information, and log data.
• An essential session cookie used to keep you signed in to the dashboard.

3. How we use personal data

• To answer calls, transcribe speech, understand requests, and hold the conversation.
• To look up and validate addresses and estimate fares by distance.
• To create, mirror, and update bookings, and pass them to the operator's dispatch system.
• To provide the dashboard — calls, transcripts, bookings, customers, and analytics.
• To operate, secure, monitor, and improve the reliability of the Service, and for billing.

Our lawful bases (as controller) are the performance of our contract with operators and our legitimate interests in running and securing the Service. When acting as a processor, we rely on the operator's lawful basis and instructions.

4. Voice recordings and transcripts

Call audio is streamed to our speech-to-text provider and processed in real time; we do not retain the raw audio beyond what is necessary to handle the live call. The text transcript is stored with the call record so operators can review the conversation and the booking it produced. Operators are responsible for informing their callers that calls are answered by an automated AI assistant and may be recorded and transcribed.

5. Service providers (sub-processors)

We use trusted third parties to deliver parts of the Service. They process personal data only to provide their function to us:

• Google — large-language-model understanding (Gemini) and Maps / Geocoding for addresses and distances.
• Deepgram — real-time speech-to-text (transcription).
• Cartesia and ElevenLabs — text-to-speech (the agent's voice).
• Supabase — database, authentication, and storage hosting.
• Cabree — dispatch integration, where an operator connects it.
• Meta (WhatsApp Business Platform) — delivery of order-confirmation messages through the merchant's own WhatsApp Business account.
• Shopify — the e-commerce platform a merchant's store runs on, for the order-confirmation app.
• Cloud infrastructure and hosting providers that run the Service.

Operators may configure their own provider API keys; where they do, those providers act on the operator's account. We store such keys encrypted (AES-256-GCM) and never expose them in the dashboard.

6. International transfers

Some of our providers are located outside the United Kingdom (for example in the United States). Where personal data is transferred internationally, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses.

7. Data retention

We keep account data for as long as an operator's account is active and as needed for legal, accounting, and security purposes. Caller, call, and booking data is retained for the operator (as controller) according to their instructions and their own retention rules; when an account is closed, we delete or return the associated data within a reasonable period unless we are required to keep it.

For Shopify stores, we also honor Shopify's data-protection webhooks: a customer redaction request deletes that customer's order-confirmation records, and a shop redaction request (sent after the app is uninstalled) deletes all of that store's data.

8. Security

• Data is encrypted in transit using TLS.
• Sensitive credentials, such as third-party API keys, are encrypted at rest with AES-256-GCM.
• Access is restricted, and dashboard data is scoped per operator (tenant isolation).

9. Your rights

Under UK data protection law you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. To exercise a right relating to your Vokl account, contact us at privacy@vokl.co.uk. Passengers should contact the relevant taxi operator, who is the controller of that data. You also have the right to complain to the UK Information Commissioner's Office (ICO).

10. Cookies

We use only essential cookies required to sign you in and keep your dashboard session secure. We do not use advertising or cross-site tracking cookies.

11. Children

The Service is intended for taxi operators and their booking lines, not for children, and we do not knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above and, where appropriate, notified to operators.

13. Contact

Questions about this policy or your data? Email privacy@vokl.co.uk. Vokl is operated by Cabree LTD, United Kingdom.