Privacy Policy
SpokenStock Ltd · Last updated: 27 August 2026 · Version 1.9
Who we are
SpokenStock Ltd (“SpokenStock”, “we”, “us”), a company registered in England and Wales (company number 17320502), provides a voice-based stock-taking service for hospitality businesses. This policy explains how we handle personal data. For questions, contact data@spokenstock.com.
Controller and processor
SpokenStock acts as a controller for its own business contacts and website enquiries, and as a processor for the data our clients put through the SpokenStock service: staff account details (name, work email), stock data, and voice recordings during a count. Where we act as a processor, the client is the controller, we process only on their documented instructions under a written Data Processing Agreement, and the client’s own privacy notice governs that data. If you are a member of a client’s staff, your employer’s notice applies, and we will direct any request you send us to them.
What we collect as a controller
| Data | Why | Lawful basis |
|---|---|---|
| Your name, email, and the content of any enquiry you send us | To respond to you and, if relevant, discuss providing our service | Legitimate interests (responding to your enquiry) |
| Basic, non-tracking server logs (e.g. IP address) from our hosting provider | Security and reliability of the website | Legitimate interests (keeping the site secure) |
We do not use advertising or tracking cookies on this website, and we do not run web analytics that profile you.
Who we share it with
We use a small number of service providers to run this website and respond to enquiries, each bound by data-processing terms:
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Website hosting | UK / US |
| Resend | Enquiry email | EU |
For the SpokenStock service we use the following sub-processors, current at the date shown above.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | UK |
| Vercel | Application hosting | UK / US |
| Speechmatics | Speech-to-text | UK / EU |
| Google (Gemini API) | Speech-to-text and count processing; recordings are not retained | US |
| Resend | Transactional email | EU |
| Sentry | Error monitoring | EU / US |
| GitHub (Microsoft) | Encrypted backup storage | US |
Customer stock data is stored in the UK. These providers and sub-processors act only on our instructions under data-processing terms; where one operates outside the UK, transfers are protected by approved safeguards. The service list appears in each client’s Data Processing Agreement, we notify clients in advance when it changes, and you can request further detail at data@spokenstock.com.
We never sell personal data.
How long we keep it
Enquiry correspondence is kept only as long as we need it to deal with your enquiry and any relationship that follows, then deleted.
Data we process for clients is kept for the periods set out in their agreement. A voice recording is kept only while the count it belongs to is being made and checked, and never for longer than 2 days. The written record of a completed count is kept for 12 months. The working transcript of a count still in progress is kept until that count is completed or discarded. A site’s stock-count history is kept for as long as we provide the service, so clients keep a complete record. Encrypted backups are kept for 90 days on a rolling basis.
Your rights
Under UK GDPR you can ask to access, correct, delete, restrict, or object to our use of your personal data. To exercise any of these, email data@spokenstock.com. If your data is held by us as a processor for an employer, we will direct your request to them. You can also complain to the ICO at ico.org.uk/make-a-complaint.
Changes
We may update this policy; the current version always lives at this address, with the date shown above.