Privacy policy
Draft for early access. This page hasn't yet been reviewed by a solicitor. It describes what Vocial actually does today.
Who is responsible
When you sign up to Vocial, Automation Bureau is the data controller for your account: we decide what Vocial collects and why, and we answer for it. Vocial is our product, not a separate company.
What we hold
- Your account: name, email address, and a password stored only as a one-way hash. Your mobile number if you give one, used only for WhatsApp updates you've switched on.
- Your business: its name, website, description, colours and logo, and what we read from your website if you ask us to scan it.
- What you upload: photos, videos and screen recordings, and the scripts, videos and posts Vocial makes from them.
- Your clone, only if you choose to make one: photos of your face, recordings of your voice, an optional talking video, and the voice model made from those recordings, with the name and date you gave consent. See below.
- Billing: your plan, credit history and a Stripe customer reference. Card details go straight to Stripe and never reach Vocial.
- Security records: sign-in attempts (kept for 15 minutes, to stop password guessing) and standard server logs.
Your face and voice
A clone is made from your face and voice, so we treat it with extra care. We only make one after you give explicit consent, in your own name, on the consent step. It's used for one thing: making videos you ask for, in your account. It is never shared with other accounts, used in the shared library, sold, or used to train anything.
Your cloned voice is made on our own server; your recordings aren't sent to a voice company. If you use talking from a photo, that photo and the narration for that one video are sent to fal.ai to animate it (see below).
You can withdraw consent at any time from You → Permission and deletion. That deletes the clone's photos, voice recordings, voice model and every video made from them, straight away.
Why we use it
- To provide Vocial to you: to make your videos and posts, run your schedules and keep your account working (the contract between us).
- Your face and voice: only with your explicit consent, which you can withdraw.
- To keep Vocial secure and to keep billing and tax records (our legal obligations and legitimate interests).
No advertising, no selling of data, and no analytics or tracking scripts on any page.
Who else is involved
These companies help run Vocial and only receive what's needed for their part:
- Amazon Web Services: the server and database, in London (eu-west-2).
- Stripe: payments for plans and credits.
- Anthropic (Claude): writes scripts and reads the photos you add, from your prompt, your business details and that photo.
- fal.ai: only when you use talking from a photo, AI motion or AI photos of you. Receives the photo and, for talking videos, that video's narration.
- OpenAI: only if you switch on the optional Astra writer.
- Google: only as a backup for AI motion, if it's switched on.
- Our email provider: account emails such as password resets.
- WhatsApp (Meta), through our automation provider: only if you turn on WhatsApp updates. Receives your number and a short message.
Some of these are based in the USA. Where your data leaves the UK, it's under those providers' business terms and the safeguards they offer for UK data. We use their paid business services, not consumer apps, and we never use your data to train anything ourselves.
Cookies
Two cookies, both strictly necessary: one keeps you signed in, the other protects forms from being submitted by another site. No cookie banner, because there's nothing optional to agree to.
How it's protected
Everything travels over HTTPS. Passwords are hashed. Your uploads, clone and videos open only for you; links shared with an automation tool expire after 7 days. Sign-in attempts are rate-limited. Keys for outside services are stored encrypted.
How long we keep it
See what we keep, and for how long. In short: while your account exists, and gone when you delete it.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, delete it, or object to how it's used. Most of this you can do yourself on the You page, including deleting your whole account. For anything else, email info@automationbureau.co.uk and we'll act within one month.
If you're not happy with how we've handled it, you can complain to the Information Commissioner's Office at ico.org.uk.