Privacy policy

1. Who is responsible

VOXIT Limited, registered in England and Wales, company number 06056088. Registered office: 24 Landport Terrace, Portsmouth, Southsea PO1 2RG.

VOXIT Limited is the controller for account administration, service security and support information that we process for our own purposes. Contact support@voxit.co.uk with the subject “Privacy”, or write to our registered office.

Where an organisation supplies personal information for us to process solely on its instructions, that organisation is the controller and we act as its processor under the applicable agreement. Your organisation’s administrator may control your access, settings and records. Contact that organisation about its own use of your information.

2. Information we handle

Account and contact information: names, login and alert email addresses, company details, address, telephone number, account role and security settings. Our authentication provider processes credentials and authentication factors to operate sign-in and recovery.

Service information: domains, website addresses, selected checks, DNS and registration records, IP addresses and reverse DNS, certificate information, response times, check results and history, alerts and delivery records, tags, maintenance windows, configuration and administrator activity. Public registration records and website content can contain personal information.

Connected WordPress information includes site identity, core, plugin and theme versions, update availability, connection status and update-job results. The connector is not designed to collect posts, customer records or WordPress login passwords. Where screenshot or rendered-website features are enabled, a captured public homepage may contain visible personal information.

We record the policy version and time of signup agreement, acknowledgment of the privacy and cookie notices, and your declaration that you are authorised to monitor the domains you add. This is an account and compliance record, not marketing consent.

Technical and support information can include IP addresses, browser and device information, timestamps, security events, request logs and information you provide when contacting us. Avoid supplying unnecessary sensitive information.

3. Sources and purposes

Information comes from you, your organisation’s administrators, your use of the service, connected websites, public DNS and registration services and enabled service providers. We use it to provide accounts and monitoring, deliver requested alerts, respond to support enquiries, investigate faults and misuse, administer the service and meet legal obligations.

For individual contracting customers, necessary processing may be based on performance of a contract. For staff and business contacts, and for service administration and security, we generally rely on legitimate interests in providing and protecting the service, balanced against individual rights. Legal obligations are the basis where processing is required by law. If we introduce optional processing requiring consent, we will explain it and seek consent separately.

We do not use monitoring results to make solely automated decisions producing legal or similarly significant effects about people. Security controls may restrict access or requests; contact us if you need a restriction reviewed.

4. Who can receive information

Authorised administrators can manage and view client information. Client users can access information assigned to their client area. Alert emails send relevant domain findings to configured recipients; check the address before saving it.

Service providers include Supabase for database and authentication, Netlify for application hosting and execution, Resend for email delivery, and Cloudflare Turnstile for abuse protection. Enabled browser-rendering or threat-reporting features can use Cloudflare Browser Rendering or Google Web Risk. These optional features may not be connected for every account.

DNS resolvers, registries, registrars and monitored websites receive the domain names, addresses or requests necessary to perform a lookup or check. Their public services may operate under their own privacy notices. We may also disclose necessary information to professional advisers or authorities where legally required or justified. We do not sell personal information.

5. International processing

Our providers operate internationally, so information may be processed outside the UK. The location and transfer arrangements depend on the provider, service and account configuration. Contact us for information about the arrangements applicable to your data and a copy or description of relevant safeguards.

UK data protection law requires an appropriate basis for restricted transfers, such as an applicable adequacy decision or approved contractual safeguards and any necessary supplementary measures. This notice is not a representation that every record stays in the UK.

6. Retention and deletion

Account and client records are retained while needed to provide and administer the relationship. Monitoring history, alerts and activity records are retained while needed for the requested history, troubleshooting, security and contractual purposes. Relevant records may be kept longer where necessary for legal obligations, disputes or the establishment or defence of claims. Retention is assessed by purpose, sensitivity, continuing need and applicable requirements; there is no single deletion period for all records.

Archiving a client retains its information and is not erasure. Permanent deletion removes associated records through the application’s deletion functions, but copies can remain temporarily in provider backups or operational logs, subject to their retention arrangements. Downloaded exports, delivered emails and copies held by your organisation are not deleted by removing an app record. Contact us for a deletion request or details of applicable retention periods.

7. Your rights

Depending on the circumstances, UK data protection law gives you rights to be informed, access your personal data, correct inaccuracies, request erasure or restriction, object to processing (including processing based on legitimate interests), and receive or transfer certain data. Where consent is the basis, you may withdraw it without affecting prior lawful processing. These rights are not absolute.

Contact support@voxit.co.uk to exercise a right. We may need proportionate identity checks and clarification to protect your information. We normally respond within one month, subject to lawful extensions. Where we act as a processor, we will direct or assist the request to the relevant controller.

You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or call 0303 123 1113. You do not have to contact us first, although we welcome the opportunity to help.

8. Security, children and changes

We use access controls and authentication safeguards to protect information, but no service can guarantee absolute security. Enable two-factor authentication, protect connection keys and use a secure device. The service is intended for business users, not children.

The Cookie Policy explains browser storage and security technologies. We update this notice when practices change and will draw significant changes to users’ attention where appropriate. The revision date appears above.