Privacy Policy
SpokenStock Ltd · Last updated: 5 August 2026 · Version 1.7
Who we are
SpokenStock Ltd (“SpokenStock”, “we”, “us”), a company registered in England and Wales (company number 17320502), provides a voice-based stock-taking service for hospitality businesses. This policy explains how we handle personal data. For questions, contact data@spokenstock.com.
Controller and processor
SpokenStock acts as a controller for its own business contacts and website enquiries, and as a processor for the data our hospitality clients put through the SpokenStock service: staff account details (name, work email), stock data, and voice recordings during a count. Where we act as a processor, the client is the controller, we process only on their documented instructions under a written Data Processing Agreement, and the client’s own privacy notice governs that data. If you are a member of a client’s staff, your employer’s notice applies, and we will direct any request you send us to them.
What we collect as a controller
| Data | Why | Lawful basis |
|---|---|---|
| Your name, email, and the content of any enquiry you send us | To respond to you and, if relevant, discuss providing our service | Legitimate interests (responding to your enquiry) |
| Basic, non-tracking server logs (e.g. IP address) from our hosting provider | Security and reliability of the website | Legitimate interests (keeping the site secure) |
We do not use advertising or tracking cookies on this website, and we do not run web analytics that profile you.
Who we share it with
We use a small number of trusted service providers to run this website and respond to enquiries, each bound by data-processing terms:
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Website hosting | UK / US |
| Resend | Enquiry email | EU |
For the SpokenStock service we use the following sub-processors, current at the date shown above.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | UK |
| Vercel | Application hosting | UK / US |
| Speechmatics | Speech-to-text | UK / EU |
| Google (Gemini API) | Transcript processing; no audio is sent | US |
| Resend | Transactional email | EU |
| Sentry | Error monitoring | EU / US |
| GitHub | Encrypted backup storage | US |
Customer stock data is stored in the UK. These providers and sub-processors act only on our instructions under data-processing terms; where one operates outside the UK, transfers are protected by approved safeguards. The service list appears in each client’s Data Processing Agreement, we notify clients in advance when it changes, and you can request further detail at data@spokenstock.com.
We never sell personal data.
How long we keep it
Enquiry correspondence is kept only as long as needed to deal with your enquiry and any resulting relationship, then deleted. Data we process on behalf of clients is kept for the periods set out in their agreement. As a guide: the voice transcripts behind a count (the written record of what was said) are kept for up to 12 months and then deleted, while a site’s stock-count history is kept for as long as we provide the service, so clients keep a complete record. Encrypted backups are kept on a rolling 90-day window. Full retention details, including for any voice data, are set out in the data processing agreement with each client.
Your rights
Under UK GDPR you can ask to access, correct, delete, restrict, or object to our use of your personal data. (The right to data portability applies only where processing is based on consent or a contract, which is not the basis on which we hold enquiry or log data, so it does not generally apply here.) To exercise any of these, email data@spokenstock.com. If your data is held by us as a processor for an employer, we will direct your request to them. You can also complain to the ICO at ico.org.uk/make-a-complaint.
Changes
We may update this policy; the current version always lives at this address, with the date shown above.